Re: logwatch scripts for cfengine

[Adams, Russell L.]

Off topic I guess... But log administration is important! ;]

I use a centralized syslog server running syslog-ng, for some twenty
odd hosts. The logs end up in a directory tree, similar to
/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$LOGLEVEL_YYMMDD. This makes
rotation and cleanup a breeze.

We parse the logs with LogMuncher for email/paging of content by host
every five minutes. LogMuncher understands the directory tree just
fine. Works alot like LogSentry (or LogCheck as it used to be
called). You have include/exclude tables for messages, and then
default to notifying on any remaining messages that weren't handled.

I make cfengine syslog various messages after completing certain
actions, and including some manual calls to the logger shellcommand
for me to pickup in the LogMuncher reports.

I'm looking at feeding some of that data into Nagios so that I can
have a warning when its been X days since action Y reported in.

Russell

On Tue, May 03, 2005 at 03:01:51PM +1000, Tim Nelson wrote:
> On Mon, 2 May 2005, Yaroslav Halchenko wrote:
> 
> >Dear Cfengineers,
> >
> >Did anyone create logwatch scripts for cfengine? I would bet they can be
> >useful - I'm using logwatch to keep an eye on a few hosts.
> 
>       What do you mean here?  Do you mean a logwatch module that 
> interprets messages that cfengine puts in syslog?
> 
>       I use Logwatch, but as soon as I have the resources, I'll get it 
> rewritten to deal with multiple hosts logging to a central server to cut 
> down on the number of e-mails we receive.  Kirk (Logwatch lead) has agreed 
> to this in principle, but this was a few years back.
> 
>       :)
> 
> -- 
> Tim Nelson
> Server Administrator
> WebAlive Technologies Global
> Level 1 Innovation Building, Digital Harbour
> 1010 LaTrobe Street
> Docklands, Melbourne, 
> Vic, 3008
> Phone: +61 3 9934 0812
> Fax: +61 3 9934 0899
> E-mail: tim.nelson@webalive.biz
> http://www.webalive.biz/
> 
> "Your Business, Your Web, Your Control"
> 
> 
> _______________________________________________
> Help-cfengine mailing list
> Help-cfengine@gnu.org
> http://lists.gnu.org/mailman/listinfo/help-cfengine