topic Re: How to put Syslog message with priority in Operating System - Linux

How to put Syslog message with priority

Mega-Mac — Fri, 26 Oct 2007 12:13:21 GMT

I'd like to put syslog message with the priority info to /var/log/messages .
ex) crit alert emerg
Because log-watching program (JP1) looking for word "crit alert emerg" .which is messages to impact to system .
redhat syslog don't leave any priority info there by default.

How could I do that?

Re: How to put Syslog message with priority

Ivan Ferreira — Fri, 26 Oct 2007 12:57:26 GMT

Proably, with syslog you can't.

Check syslog-ng!

Re: How to put Syslog message with priority

Stuart Browne — Fri, 26 Oct 2007 19:01:25 GMT

Or just seperate the different levels into different log files.

Re: How to put Syslog message with priority

Mega-Mac — Sat, 27 Oct 2007 06:12:06 GMT

Ivan ,Stuart
Thanks to reply me.
I'd taken account of "syslog-ng",it is sure way to do this,
and To seperate log files are easiest way to go.
But I have to setup 100 redhat servers,so I was so sad.

Re: How to put Syslog message with priority

Vitaly Karasik_1 — Sun, 28 Oct 2007 03:45:35 GMT

>I'd like to put syslog message with the priority info to /var/log/messages .

I afraid, I don't understand you.
Do you mean "add some log entry with specific priority"? - it's trivial with "logger"(1).

Re: How to put Syslog message with priority

Mega-Mac — Sun, 28 Oct 2007 06:00:45 GMT

Hi,Vitaly
Thanks to reply me.
My English skill is not enough,that is my apology.
I mean,
for exam,following /var/log/messages have a error,but I can't decide these message are crical to system or not.
Oct 22 09:14:12 CMRECV05 kernel: hda: irq timeout: error=0x00
CMRECV05 kernel: shpchp: acpi_shpchprm:get_device PCI ROOT HID fail=0x1001

After all,these above messages are harmless,(HP support guy said).
If /var/log/messages had included the priority infomation (crit,alert,emerg),easier to find out importnat messages and watch them from log-watching program (JP1 or Openview).
Could it be a good explanation for you?

Re: How to put Syslog message with priority

Vitaly Karasik_1 — Sun, 28 Oct 2007 06:18:00 GMT

Thank you for your explanation!
To say the truth, till now I was sure that syslogd saves priority info into syslog!!!
It's really strange that standart syslogd doesn't know to do this...

Re: How to put Syslog message with priority

Stuart Browne — Sun, 28 Oct 2007 14:50:43 GMT

100 servers, and you aren't using centralized logging? How strange.

I'd also assume you're using the same syslogd on all servers, so it should be one changed pushed to 100 servers, no big deal.

Even if it's not, 2-3 lines of script executed on each machine should do it.

Re: How to put Syslog message with priority

Heironimus — Mon, 29 Oct 2007 10:22:10 GMT

If you really want to use that approach the way you would do it with a standard syslog is to send a copy of all messages with the relevant priorities to a new log and point your log monitor at that file instead of at /var/log/messages.

However, the syslog or kernel priority doesn't necessarily reflect the priority of the message to you. A log scraper is not a suitable replacement for qualified personnel.

Re: How to put Syslog message with priority

Mega-Mac — Mon, 29 Oct 2007 12:12:12 GMT

To Stuart
>you aren't using centralized logging?
You absolutely right!
My customer doesn't care about centralizing syslod,because maybe log-watch program(JP1,OpenView) patrol them I think.

To Heironimus
Thanks to reply me.
I have a small English problem ,but well....
How do you watch logs,pick up important logs and what are filter words.
Best regards,

Re: How to put Syslog message with priority

Heironimus — Mon, 29 Oct 2007 16:07:34 GMT

A UNIX system puts a lot of information in to its logs. I've only seen places scan log files when they could find no other way to do alerting. Many faults can be identified more reliably through other means. The only time it really works to watch log files is when you know exactly what to expect.

I guess the real question is what kind of alerts you're looking for. Hardware is often best monitored with agents supplied by the vendor. The HP health agents can report some errors that usually won't make it in to the system logs, like a failed drive in an array or correctable memory errors.

Re: How to put Syslog message with priority

Mega-Mac — Tue, 30 Oct 2007 08:53:38 GMT

I seem to have reached the answer.
I'll withdraw to filter syslogs by word.
It's enough to watch the hardware,disk free space,process by agent like(JP1,OPV) ,and use syslog message for analyzing.
Thanks everyone