/var/adm/syslog/syslog.log monioring

[B V B Kumar]

Hi,

i want to find critical messages in the /var/adm/syslog.log file. Is there any procedure for identifying the messages (like category wise critical,warning,notice). Anybody is having documention on this.

Thanks
Kumar

[SUDHAKAR_18]

Hi BVBK,

You write one script .for ex dailyscript.

include following lines,
grep -i full /var/adm/syslog/syslog.log
grep -i lbolt /var/adm/syslog/syslog.log
grep -i fail /var/adm/syslog/syslog.log
grep -i Error /var/adm/syslog/syslog.log
grep -i incorrect /var/adm/syslog/syslog.log
grep -i scsi /var/adm/syslog/syslog.log
grep -i lvm /var/adm/syslog/syslog.log
grep -i fault /var/adm/syslog/syslog.log
grep -i disable /var/adm/syslog/syslog.log


on daily basis run the script to check your syslog.
Ex: sh dailyscript |grep 'Apr 22'

Hope this helps!

[Matti_Kurkela]

To allow the identification of syslog messages by category, you could add "-v" to the startup options of syslog. See the comments in the /etc/rc.config.d/syslogd file.

After editing that file, restart syslogd:
/sbin/init.d/syslogd stop
/sbin/init.d/syslogd start

Read "man 3c syslog" to understand the facility/level codes added by this option.

An alternative approach would be to edit /etc/syslog.conf to store the log messages to various separate files according to their priority levels.

MK

[MarkSyder]

Have you thought of installing Big Brother? (Sorry, I don't have the link to hand.)

You can configure it to send an alert whenever it detects (for example) "WARNING" in the syslog.

Mark Syder (like the drink but spelt different)