Mailing List Archive: Log consolidation?

Log consolidation?

Aug 13, 2001, 10:15 AM

Post #1 of 4 (676 views)

All,

I'm running Conserver 7.0.3 (and will be upgrading to 7.1.1 any day now.) I
currently have 113 managed consoles and, as a result, have 113 distinct
logfiles, one per console. I have been looking at swatch
(http://oit.ucsb.edu/~eta/swatch/) as a way of keeping an eye out for
various "events" that I would like to be notified of. For instance, a full
file system, a failing or failed disk, etc. (Most of my consoles are UNIX
boxes.) However, swatch is able to watch only a single file. In order to
watch all my consoles, I have to run 113 instances of swatch (BTW, swatch is
a perl script.). Is there a way to send some or all of my console logs to
syslog (in addition to or instead of individual log files). I would love to
continue to have all the individual log files PLUS be able to also point all
console output to a specific syslog "facility.level" so syslog could
aggregate the records into a single file that swatch could watch.

Any ideas? In the meantime, I'm going to try firing up a whole bunch of
swatch processes. :-)

Matt
--
Matthew Cheek | Medical Archival Systems, Inc. (A/K/A MARS)
Systems Analyst III | 1370 Beulah Road | Pittsburgh, PA 15235-5084
cheek@mars-systems.com | v: 412-473-6565 | f: 412-473-6538

Re: Log consolidation? [ In reply to ]

bryan at conserver

Aug 13, 2001, 6:33 PM

Post #2 of 4 (666 views)

Permalink

On Mon, Aug 13, 2001 at 01:15:08PM -0400, Matt Cheek wrote:
> a perl script.). Is there a way to send some or all of my console logs to
> syslog (in addition to or instead of individual log files). I would love to
> continue to have all the individual log files PLUS be able to also point all
> console output to a specific syslog "facility.level" so syslog could
> aggregate the records into a single file that swatch could watch.

Not with the current code.

> Any ideas? In the meantime, I'm going to try firing up a whole bunch of
> swatch processes. :-)

None over here (without code changes). The recent code is lending
itself more to doing stuff like that, but it's not there yet. It would
be fairly easy to be able to have a list of files (and possibly syslog)
as destinations for the output. Then you could point all consoles to a
common file as well as specific ones. Only problem there is the
logfiles themselves are not stamped with the name of the console, so
you don't know which thing generated the error.

There is the "unloved output" stuff which is kinda what you're looking
for. The output is only generated if someone *isn't* attached to a
particular console (see the manpage for a better worded explanation).
So, you could enable that (the -u option in 7.1.1) and watch that
data. It's not perfect, but would get you mostly there. If you change
to code and remove the check for no one being attached, you're 100%
there.

Yep, it's all ugly. I'll make sure the request/idea is in the TODO
file so that it will at least make myself (and others?) think about it
some more.

Bryan

Re: Log consolidation? [ In reply to ]

siegert at sfu

Aug 13, 2001, 6:58 PM

Post #3 of 4 (661 views)

Permalink

On Mon, Aug 13, 2001 at 01:15:08PM -0400, Matt Cheek wrote:
>
> I'm running Conserver 7.0.3 (and will be upgrading to 7.1.1 any day now.) I
> currently have 113 managed consoles and, as a result, have 113 distinct
> logfiles, one per console. I have been looking at swatch
> (http://oit.ucsb.edu/~eta/swatch/) as a way of keeping an eye out for
> various "events" that I would like to be notified of. For instance, a full
> file system, a failing or failed disk, etc. (Most of my consoles are UNIX
> boxes.) However, swatch is able to watch only a single file. In order to
> watch all my consoles, I have to run 113 instances of swatch (BTW, swatch is
> a perl script.). Is there a way to send some or all of my console logs to
> syslog (in addition to or instead of individual log files). I would love to
> continue to have all the individual log files PLUS be able to also point all
> console output to a specific syslog "facility.level" so syslog could
> aggregate the records into a single file that swatch could watch.
>
> Any ideas? In the meantime, I'm going to try firing up a whole bunch of
> swatch processes. :-)

You could try logcheck (www.psionic.com) instead of swatch. logcheck
works with several log files.

Martin

========================================================================
Martin Siegert
Academic Computing Services phone: (604) 291-4691
Simon Fraser University fax: (604) 291-4242
Burnaby, British Columbia email: siegert@sfu.ca
Canada V5A 1S6
========================================================================

RE: Log consolidation? [ In reply to ]

ChrisF at computone

Aug 14, 2001, 4:18 AM

Post #4 of 4 (666 views)

Permalink

I implemented some code that would do this outside of conserver. but, you
lost the replay feature. It is possible to send all the logs to syslog.

-----Original Message-----
From: Martin Siegert [mailto:siegert@sfu.ca]
Sent: Monday, August 13, 2001 9:59 PM
To: Matt Cheek
Cc: 'users@conserver.com'
Subject: Re: Log consolidation?

On Mon, Aug 13, 2001 at 01:15:08PM -0400, Matt Cheek wrote:
>
> I'm running Conserver 7.0.3 (and will be upgrading to 7.1.1 any day now.)
I
> currently have 113 managed consoles and, as a result, have 113 distinct
> logfiles, one per console. I have been looking at swatch
> (http://oit.ucsb.edu/~eta/swatch/) as a way of keeping an eye out for
> various "events" that I would like to be notified of. For instance, a full
> file system, a failing or failed disk, etc. (Most of my consoles are UNIX
> boxes.) However, swatch is able to watch only a single file. In order to
> watch all my consoles, I have to run 113 instances of swatch (BTW, swatch
is
> a perl script.). Is there a way to send some or all of my console logs to
> syslog (in addition to or instead of individual log files). I would love
to
> continue to have all the individual log files PLUS be able to also point
all
> console output to a specific syslog "facility.level" so syslog could
> aggregate the records into a single file that swatch could watch.
>
> Any ideas? In the meantime, I'm going to try firing up a whole bunch of
> swatch processes. :-)

You could try logcheck (www.psionic.com) instead of swatch. logcheck
works with several log files.

Martin

========================================================================
Martin Siegert
Academic Computing Services phone: (604) 291-4691
Simon Fraser University fax: (604) 291-4242
Burnaby, British Columbia email: siegert@sfu.ca
Canada V5A 1S6
========================================================================
_______________________________________________
users mailing list
users@conserver.com
https://www.conserver.com/mailman/listinfo/users