Re: [hobbit] System Log Monitoring

[Asif Iqbal <iqbala-hobbit (at) qwestip.net>]

On Fri, Aug 12, 2005 at 09:14:24AM, Henrik Stoerner wrote:
> On Thu, Aug 11, 2005 at 11:21:48PM -0700, Bob Gordon wrote:
> > Hello Henrick - 
> > 
> > Wondering if you had any kind of time frame for adding system log
> > monitoring into the client?  (/var/log/syslog, /var/adm/messages and
> > possibly a user configurable one)....
> 
> The thing is I don't really know what's the best way to do that.
> 
> I guess the log monitoring will need some local configuration,
> although I really hate that. But sending entire logs across the wire
> every 5 minutes won't work.
> 
> Also, I'd really like to have some mechanism for alerting different
> people depending on what log-entry triggers an alert. (Same goes for
> the "procs" and perhaps "disk" olumns, by the way - but I know how 
> to implement that).
> 
> So ideas and suggestions are welcome.

How about using something like logtail--on client--run every 5 mins and alert if
matches a string. As far as who should get be paged for the alert can
still be managed by SCRIPT.

This way no same string of unique time stamp wont be seen twice and
hence won't have to rotate the messages file manually to stop the alert.

I am sure you already thought of something better. Just making my
"voice" heard ;-)

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
"..there are two kinds of people: those who work and those who take the credit...try
 to be in the first group;...less competition there."  - Indira Gandhi