Script help in translating idea to script in ksh.

[fg_1]

Hello all.

I have been given a task to create a script that would do the following items.
1) Take errors from DMESG, /var/adm/messages, and /var/adm/syslog/syslog.log and roll them into one file, local file would be a starting point on about 20 different systems.
2) Take the local files that are created on every system containing all the errors from those other logfiles and bringing them into one system.
3) Take the local files from each system which would be named based on the system name it came from, and then combine all 20 files into one report that would be emailed to a specific group list.

Any ideas on this would be a help. Thank you in advance.

fg.

[Tom Maloy · Accepted solution]

I think that you need centralized logging with syslog. Check out the /etc/syslog.conf file - you should be able to add a line like:

*.err;kern.debug;daemon.notice;auth.notice;user.none @centralserver

which will forward a copy of those message types to your centralserver for logging. A local copy will still be kept.

Then you look through the one centralized file for error messages. Each message should be tagged with the system name that it comes from, so you will know which system had the error.

Tom

[Mark Greene_1]

As mentioned, you can set this up in syslog, see the man page for syslogd. Also considering the file size will be very large with 20 systems, you may want to consider putting Apache on the syslog server and have people access the log files via a browser instead of duplicating megs of file space by mailing the same large file to many people.

HTH
mark

[fg_1]

Guys that is a good suggestion so far and I am definitely going to look into that.

I want to clarify one point that I am trying to accomplish, that is the point that all I want to take out of the current syslog, dmesg, and /var/adm/messages files are ERRORS that occurr (not the entire log files). These errors would then be written to the system (ERROR log file) on each system. Then I would like to take those (ERROR LOG FILES) from each system and bring them into one big (ERROR LOG FILE), then email that one file.

Thanks again for the suggestions so far.

[Tom Maloy]

Frank,

You can selectively forward messages by setting that line in /etc/syslog.conf. If you do a "man syslogd" and "man logger" you will see the different severity levels (*.crit, *.emerg, *.err, ...) that you can choose from. And you can eliminate some classes with constructs like "user.none".

Tom

[Deshpande Prashant]

HI
Try this.
##
LOGDIR=/home/system/log
for host in hp01 hp02 hp03 hp04
{
remsh $host "dmesg" >> $LOGDIR/$host-log
remsh $host "cat /var/adm/messages" >> $LOGDIR/$host-log
remsh $host "cat /var/adm/syslog/syslog.log" >> $LOGDIR/$host-log
}
DATE=`date +%d%b%Y`
cat $LOGDIR/hp*-log >> $LOGDIR/HPLOG.$DATE

uuencode LOGDIR/HPLOG.$DATE HPLOG |mailx -m -s "HP LOGS" user@domain.com

##
Not tested..
You can modify as you need.

Thanks.
Prashant.