[hobbit] Limited amount of log data

[ken.schweiker at faa.gov]

Thanks for the reply. I did read it. Took me all over trying to find that
little gem. Is there a Hobbit for Dummies book yet?  But, without going
through all that again where can I find the settings to change this? Also,
about the screen shot below about no log entries in var/log/messages. Is
that normal? Will that go away if I filter log messages? Thanks again.



                                                                           
             "Hubbard, Greg L"                                             
             <greg.hubbard at eds                                             
             .com>                                                      To 
                                       <hobbit at hswn.dk>                    
             03/05/2009 05:36                                           cc 
             PM                                                            
                                                                   Subject 
                                       RE: [hobbit] Limited amount of log  
             Please respond to         data                                
              hobbit at hswn.dk                                               
                                                                           
                                                                           
                                                                           
                                                                           
                                                                           




The design of the log watching system is to scan a subset of a log for
"bad" things and update the status dot.  If it did not have a rolling
"time window" then the status dot would never change after something
ugly got put in the log file.  And then the process of reading the log
file (and pumping it to the server) would get slower and slower as the
log file grows.  This feature is not designed for log management, but
for helping you watch for things that might appear in the logs on each
host that might require your attention.

You might want to read the documentation -- you have to configure the
rules that define what "bad" means.

GLH

-----Original Message-----
From: ken.schweiker at faa.gov [mailto:ken.schweiker at faa.gov]
Sent: Thursday, March 05, 2009 4:07 PM
To: hobbit at hswn.dk
Subject: [hobbit] Limited amount of log data


Hi,
Trying to set up xymon to capture log data. Once I changed the
permission on the var/log/message file, I got -some- data. I am taking
the defaults with xymon 4.2.3. I might appear that I only get to see the
last 30 minutes of log data. Can this be increased?

Second, why does it say No entries in /var/log/messages.
Thanks.
System logs at Thu Mar 5 17:03:20 EST 2009



No entries in /var/log/messages


Full log /var/log/messages
Mar  5 16:56:00 tcdcpega syslog-ng[1494]: STATS: dropped 0



To unsubscribe from the hobbit list, send an e-mail to
hobbit-unsubscribe at hswn.dk



To unsubscribe from the hobbit list, send an e-mail to
hobbit-unsubscribe at hswn.dk