RE: [hobbit] Limited amount of log data

["Hubbard, Greg L" <greg.hubbard (at) eds.com>]

The design of the log watching system is to scan a subset of a log for
"bad" things and update the status dot.  If it did not have a rolling
"time window" then the status dot would never change after something
ugly got put in the log file.  And then the process of reading the log
file (and pumping it to the server) would get slower and slower as the
log file grows.  This feature is not designed for log management, but
for helping you watch for things that might appear in the logs on each
host that might require your attention.

You might want to read the documentation -- you have to configure the
rules that define what "bad" means.

GLH 

-----Original Message-----
From: ken.schweiker (at) faa.gov [mailto:ken.schweiker (at) faa.gov] 
Sent: Thursday, March 05, 2009 4:07 PM
To: hobbit (at) hswn.dk
Subject: [hobbit] Limited amount of log data


Hi,
Trying to set up xymon to capture log data. Once I changed the
permission on the var/log/message file, I got -some- data. I am taking
the defaults with xymon 4.2.3. I might appear that I only get to see the
last 30 minutes of log data. Can this be increased?

Second, why does it say No entries in /var/log/messages.
Thanks.
System logs at Thu Mar 5 17:03:20 EST 2009



No entries in /var/log/messages


Full log /var/log/messages
Mar  5 16:56:00 tcdcpega syslog-ng[1494]: STATS: dropped 0



To unsubscribe from the hobbit list, send an e-mail to
hobbit-unsubscribe (at) hswn.dk