One thing to watch out for would be multi-line log messages. I
don't know about Linux, but Solaris certainly reports some device
messages with WARNING or ERROR on the first line, and the actual device
on the next line with more information. Where I work, the jokers
that set up CA Unicenter made it detect WARNING & ERROR and
had the agent send "Disk error" messages to the console, and never mind
that the device was /dev/st0 (scsi *tape*) and it just wanted cleaning,
or a fresh tape...<br>
<br>
I seem to recall that the second and subsequent lines were indented a
couple of spaces. Kinda like Linux seems to do, such as in the
lines right after:<br>
<br>
BIOS-provided physical RAM map:<br>
<br>
and several other places in the boot messages.<br>
<br>
Ralph Mitchell<br>
<br><br><div><span class="gmail_quote">On 2/3/06, <b class="gmail_sendername">Edward Croft</b> <<a href="mailto:ecroft@openratings.com">ecroft@openratings.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Yes, Linux based. I will have to look into what you are doing. I
am wondering if maybe a grep on the log file with the expression
"WARNING" would return only those warnings. Then bump up against the
timestamp to see if it is old. Beyond an hour, ignore it. This would
give me the alert and then I could shut it off and it would go past the
time stamp. Big Brother gave you a file to show for each machine what
you were looking to alert on. <br>
Thanks for giving me a direction to go. <div><span class="e" id="q_10930a09ebc248b7_1"><br>
<br>
On Fri, 2006-02-03 at 08:41 -0500, <a href="mailto:Allan.Marillier@dana.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">Allan.Marillier@dana.com</a> wrote:<br>
</span></div><blockquote type="CITE"><div><span class="e" id="q_10930a09ebc248b7_3">
<br>
<font size="2"><font color="#000000">Hi
Edward - I understand your frustration - I've been through the same
things myself, and also initially not found the FAQ indicating that
syslog monitoring is not yet supported. I believe that Henrik is making
it a priority since so many of us are asking for it but there is no
news yet or commitment from him on when it will be available.</font></font><font color="#000000"> </font><br>
<br>
<font size="2"><font color="#000000">I searched <a href="http://deadcat.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">deadcat.net</a>
and didn't find anything that looked worth using to me, but I may have
missed it. One thing I have been working on, but I've had a few
problems, is writing a custom extension. The extension itself is very
easy to do - e.g. I have written two for my Linux servers, one to run
some sql code to attach to an Oracle instance and report green if it is
up or red if it is down, and another to check LAN adapter settings and
turn yellow if it is not set to 100Mb full duplex. I have been working
on a syslog monitor which looks at /var/log/messages, checks the inode
to be sure logrotate has not run, and then uses tail to parse the last
n lines. I determine n by checking how many lines are in the file with
wc and recording that to a file on disk, then later come back and do
the same again. If the inode is the same, and wc -l returned 1000 but
now returns 1057, then I do tail -n 57 /var/log/messages | grep -i
error and look for any problems.</font></font><font color="#000000"> </font><br>
<br>
<font size="2"><font color="#000000">The
problem I've encountered is that sometimes the inode changes. Yes, it
really does and I'm not crazy, give it a try on Linux. Copy
/var/log/messages, then ls -al -i the copy. Edit it with vi, even if
all you do is open, then write and quit with no actual changes, and
more often than not, the inode will change. I don't understand it. If I
can get this working I'd be happy to share my custom extension with you
- or maybe you will have some ideas on a different and more robust
approach.</font></font><font color="#000000"> </font><br>
<br>
<font size="2"><font color="#000000">I'm assuming of course that you're Unix/Linux based, which is not always a good assumption!</font></font><font color="#000000"> </font><br>
<br>
<br>
<br>
<br>
<table width="100%">
<tbody><tr>
<td width="40%">
<b><font size="1">Edward Croft <<a href="mailto:ecroft@openratings.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">ecroft@openratings.com</a>></font></b> <br>
<br>
<font size="1">02/02/2006 05:16 PM</font> <br>
<table>
<tbody><tr>
<td bgcolor="#ffffff">
<div align="center"><font size="1">Please respond to</font></div><br>
<div align="center"><font size="1"><a href="mailto:hobbit@hswn.dk" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">hobbit@hswn.dk</a></font></div>
</td>
</tr>
</tbody></table>
<br>
<br>
<br>
<br>
</td>
<td width="59%">
<table width="100%">
<tbody><tr>
<td>
<div align="right"><font size="1">To</font></div>
</td>
<td>
<font size="1"><a href="mailto:hobbit@hswn.dk" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">hobbit@hswn.dk</a></font>
</td>
</tr>
<tr>
<td>
<div align="right"><font size="1">cc</font></div>
</td>
<td>
<br>
</td>
</tr>
<tr>
<td>
<div align="right"><font size="1">Subject</font></div>
</td>
<td>
<font size="1">Re: [hobbit] Messages file not reporting</font>
</td>
</tr>
</tbody></table>
<br>
<table>
<tbody><tr>
<td>
<br>
</td>
<td>
<br>
</td>
</tr>
</tbody></table>
<br>
<br>
</td>
</tr>
</tbody></table>
<br>
<br>
<br>
<font color="#000000">On Thu, 2006-02-02 at 22:31 +0100, Etienne Roulland wrote: </font><br>
<br>
<tt><font color="#000000">Edward Croft wrote:</font></tt><br>
<tt><font color="#000000">> Why thank you. I did find the one line:</font></tt><br>
<tt><font color="#000000">> It does not currently provide any data for the system-log "msgs" column.</font></tt><br>
<tt><font color="#000000">></font></tt><br>
<tt><font color="#000000">> That is all it says. Does not currently. Sooooo when can it be </font></tt><br>
<tt><font color="#000000">> expected, if ever?</font></tt><br>
<tt><font color="#000000">> This one thing prevents me from using it as the programs that monitor </font></tt><br>
<tt><font color="#000000">> our systems</font></tt><br>
<tt><font color="#000000">> write warnings into the log file which currently gets picked up by big </font></tt><br>
<tt><font color="#000000">> brother and an</font></tt><br>
<tt><font color="#000000">> alert sent.</font></tt><br>
<br>
<br>
<tt><font color="#000000">You can use external script from </font></tt><tt><u><font color="#0000ff"><a href="http://www.deadcat.net/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://www.deadcat.net/
</a></font></u></tt><tt><font color="#000000">to monitor your </font></tt><br>
<tt><font color="#000000">logfiles.</font></tt><br>
<br>
<br>
<tt><font color="#000000">To unsubscribe from the hobbit list, send an e-mail to</font></tt><br>
<u><tt><font color="#0000ff"><a href="mailto:hobbit-unsubscribe@hswn.dk" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">hobbit-unsubscribe@hswn.dk</a></font></tt></u><br>
<br>
<br>
<br>
<br>
<u><tt><font color="#0000ff">Thank you. I appreciate your response.</font></tt></u><br>
<table width="100%">
<tbody><tr>
<td width="100%">
<br>
<tt>-- </tt><br>
<tt>Edward M. Croft</tt><br>
<tt>Sr. Systems Engineer</tt><br>
<tt>Open Ratings, Inc.</tt><br>
<tt>200 West Street</tt><br>
<tt>Waltham, MA 02451-1121</tt><br>
<br>
<br>
</td>
</tr>
</tbody></table>
<br>
<br>
</span></div><pre><div><span class="e" id="q_10930a09ebc248b7_5"><br><u><tt><font color="#0000ff">********************************************************************************</font></tt></u><br><u><tt><font color="#0000ff">
This e-mail, and any attachments, is intended solely for use by the </font></tt></u><br><u><tt><font color="#0000ff">addressee(s) named above. It may contain the confidential or </font></tt></u><br><u><tt><font color="#0000ff">
proprietary information of Dana Corporation, its subsidiaries, </font></tt></u><br><u><tt><font color="#0000ff">affiliates or business partners. If you are not the intended recipient </font></tt></u><br><u><tt><font color="#0000ff">
of this e-mail or are an unauthorized recipient of the information, you </font></tt></u><br><u><tt><font color="#0000ff">are hereby notified that any dissemination, distribution or copying </font></tt></u><br><u><tt><font color="#0000ff">
of this e-mail or any attachments, is strictly prohibited. If you have </font></tt></u><br><u><tt><font color="#0000ff">received this e-mail in error, please immediately notify the sender </font></tt></u><br><u><tt><font color="#0000ff">
by reply e-mail and permanently delete the original and any copies </font></tt></u><br><u><tt><font color="#0000ff">or printouts.</font></tt></u><br><br><u><tt><font color="#0000ff">Computer viruses can be transmitted via email. The
</font></tt></u><br><u><tt><font color="#0000ff">recipient should check this e-mail and any attachments for the </font></tt></u><br><u><tt><font color="#0000ff">presence of viruses. Dana Corporation accepts no liability for any
</font></tt></u><br><u><tt><font color="#0000ff">damage caused by any virus transmitted by this e-mail. </font></tt></u><br><br><u><tt><font color="#0000ff">English, Francais, Espanol, Deutsch, Italiano, Portugues:</font>
</tt></u><br><u><tt><font color="#0000ff"><a href="http://www.dana.com/overview/EmailDisclaimer.shtm" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://www.dana.com/overview/EmailDisclaimer.shtm
</a></font></tt></u><br><br><u><tt><font color="#0000ff">********************************************************************************</font></tt></u><br><br></span></div><u><tt><font color="#0000ff">-- </font></tt></u>
<br><br><u><tt><font color="#0000ff">This message has been scanned for viruses and</font></tt></u><br><br><u><tt><font color="#0000ff">dangerous content by</font></tt></u><br><b><u><tt><font color="#0000ff"><a href="http://www.mailscanner.info/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
MailScanner</a></font></tt></u></b><u><tt><font color="#0000ff">, and is</font></tt></u><br><br><u><tt><font color="#0000ff">believed to be clean.</font></tt></u><br><br></pre>
</blockquote><div><span class="e" id="q_10930a09ebc248b7_7">
<table cellpadding="0" cellspacing="0" width="100%">
<tbody><tr>
<td>
<pre>-- <br>Edward M. Croft<br>Sr. Systems Engineer<br>Open Ratings, Inc.<br>200 West Street<br>Waltham, MA 02451-1121<br><br></pre>
</td>
</tr>
</tbody></table>
</span></div></blockquote></div><br>