topic Mailing errors appended to syslog in Operating System - HP-UX

Mailing errors appended to syslog

kenny chia — Wed, 08 Jan 2003 00:25:13 GMT

Hi
In order to monitor errors written to the syslog file, I've decided to write a cron job that greps words like "error" and "CRITICAL" in the syslog file and mailing them to me.

Should I include more words other than the two? Or is there a better way of notifiying me of errors or problems? thanks

Re: Mailing errors appended to syslog

harry d brown jr — Wed, 08 Jan 2003 00:32:23 GMT

look into

http://www.bb4.com/

it's rather cheap!

live free or die
harry

Re: Mailing errors appended to syslog

Rajeev Shukla — Wed, 08 Jan 2003 00:35:43 GMT

You might even grep for "Error" coz a lot of messages start with capital "E"

Rajeev

Re: Mailing errors appended to syslog

avsrini — Wed, 08 Jan 2003 00:35:57 GMT

Hi,
You can use a script to grep for error and critical from syslog file and mail you.

also check syslog.conf file, you can make syslog to send the error and critical messages to other file also.
So you can just mail that file only to you.

If your application supports, set it to send alerts to your mail id directly. Like we have omniback configured to send mails to us incase of any alerts.

Happy Monitoring
Srini.

Re: Mailing errors appended to syslog

S.K. Chan — Wed, 08 Jan 2003 00:46:43 GMT

Kind of similar discussion here in this thread.I've mentioned in that thread about having too many keywords search that simply impossible to be able to grep them all.
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x21ee56bd90a9d611abdb0090277a778c,00.html
Hope this helps ..

Re: Mailing errors appended to syslog

Trever Furnish — Wed, 08 Jan 2003 13:59:06 GMT

You've got the approach backwards - you can't possibly predict what error messages you may get, so you should instead filter out the things you know *aren't* error messages.

Of course you'll still have to be fairly specific to make sure that you don't accidentally ignore something you need to know about, but that's not that difficult since you have logs to build your patterns from.

The idea is that when nothing unusual is happening, you don't get any error reports, but when something unexpected happens (ie a line you haven't told the script to ignore), you get a report on it.

Logwatch (http://www.logwatch.org) works that way and swatch can work that way as well. There are tons of log handling tools listed here as well:
http://www.counterpane.com/log-analysis.html