monitoring syslog

[Animesh Chakraborty]

Hi,
can any one suggest what is the best way to monitor syslog everyday for several server.
I am not using ITO.
Thanx
animesh

[Jeremiah Campbell]

I run a script that remsh's to each server and grep's for keywords such as "error fail full unable terminat restart" etc... The context is fairly easy;
#############################
#!/usr/bin/sh
for server in `cat server.list`
do
for error in `cat error.list`
do
remsh $server "grep $error /var/adm/syslog/syslog.log" >> a.out
done
done
#######################
Don't forget to put a entry in each .rhosts file on each server including the one the script runs from for the machine and the uid that will run it. example:
myhp myuid

Do not use any plus + signs in the .rhosts file unless you don't care about security.

[Jeremiah Campbell]

I run a script that remsh's to each server and grep's for keywords such as "error fail full unable terminat restart" etc... The context is fairly easy;
#############################
#!/usr/bin/sh
for server in `cat server.list`
do
for error in `cat error.list`
do
remsh $server "grep $error /var/adm/syslog/syslog.log" >> a.out
done
done
#######################
Don't forget to put a entry in each .rhosts file on each server including the one the script runs from for the machine and the uid that will run it. example:
myhp myuid

Do not use any plus + signs in the .rhosts file unless you don't care about security.

You need to put all your servers one-per-line in the server.list file, and any keywords you want to look for in error.list.

[Denver Osborn]

you could set it up so that the syslogd on one system will send the messages to another system. Then you could monitor one system's syslog for multiple systems.

Use the @host option in the /etc/syslog.conf file then execute: kill -HUP `cat /etc/syslog.pid` to reread the changes made to syslog.conf

# man 1M syslogd

[Kofi ARTHIABAH]

I would rather go with Denver's option - and in addition to that, you can have a script that greps for particular keywords "fail|error|warn|alert|" and send an e-mail to you.

eg.
egrep -i 'fail|error|warn|alert|' | mail -s "syslog error/fail messages" yourself@your.domain.com

[Kofi ARTHIABAH]

I would rather go with Denver's option - and in addition to that, you can have a script that greps for particular keywords "fail|error|warn|alert|" and send an e-mail to you.

eg.
egrep -i 'fail|error|warn|alert|' | mail -s "syslog error/fail messages" yourself@your.domain.com

[Kofi ARTHIABAH]

I would rather go with Denver's option - and in addition to that, you can have a script that greps for particular keywords "fail|error|warn|alert|" and send an e-mail to you.

eg.
egrep -i 'fail|error|warn|alert|' /var/adm/syslog/syslog.log | mail -s "syslog error/fail messages" yourself@your.domain.com