Eventlog

[Carroll, Jim P [Contractor]]

Very interesting.  Thought provoking, even.

We're using the Perl version of check_log here for checking for 'warning'
type msgs, as well as a tweaked version of same checking for 'critical' type
msgs.  It's been pretty good, but has been perplexing at times how best to
handle things, not the least of which deals with the issue of central vs.
host-based syslog scrubbing.  One issue is how to stop repeated
notifications once you're aware of the problem, eg, a bad disk block.  At
the individual host level, I've set check_log.pl to be volatile, since it
fit the description (and since the non-volatile behaviour was problematic).

I'd be interested in hearing how you dealt with issues such as this.

This relates to Nagios, and yet it doesn't.  If noone else on the list jumps
in before the end of the day, maybe you and I can take this off-list.

jc


> -----Original Message-----
> From: Russell Adams [mailto:RLAdams at Kelsey-Seybold.com]
> Sent: Wednesday, April 02, 2003 10:06 AM
> To: nagios-users at lists.sourceforge.net
> Subject: Re: [Nagios-users] Eventlog
> 
> 
> -= Sorry, here's the list copy. :P =-
> 
> I use EventReporter, http://www.eventreporter.com/en/ .
> 
> Its cheap ($50/host before bulk discounts), and I've never had a
> problem with it.
> 
> Quite frankly, I don't use "check_log". Monitoring my system logs is a
> job for my central syslog server, running syslog-ng, with email/paging
> reports by LogMuncher (a distant relative of LogSentry, but thats not
> available anymore). See http://www.campin.net/newlogcheck.html for
> suggestions.
> 
> Russell
> 
> On Wed, Apr 02, 2003 at 10:53:56AM +0200, Johannes Dagemark wrote:
> > Hello
> > 
> > I would like to monitor the eventlog on a couple of w2k 
> boxes. The idea so far
> > is to install a program on the w2k boxes that sends the 
> entries in the eventlog
> > to a syslogserver and then use the check_log plugin to 
> check for certain
> > problems.
> > 
> > Can anyone recommend a good software (small, simple and 
> free) that can send
> > entries in the eventlog to syslog or is there someone that 
> has a better idea?
> > 
> > Regards
> > 
> > Johannes Dagemark
> > 
> > 
> > 
> > -------------------------------------------------------
> > This SF.net email is sponsored by: ValueWeb: 
> > Dedicated Hosting for just $79/mo with 500 GB of bandwidth! 
> > No other company gives more support or power for your 
> dedicated server
> > http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/
> > _______________________________________________
> > Nagios-users mailing list
> > Nagios-users at lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/nagios-users
> > ::: Please include Nagios version, plugin version (-v) and 
> OS when reporting any issue. 
> > ::: Messages without supporting info will risk being sent 
> to /dev/null
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: ValueWeb: 
> Dedicated Hosting for just $79/mo with 500 GB of bandwidth! 
> No other company gives more support or power for your dedicated server
> http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/
> _______________________________________________
> Nagios-users mailing list
> Nagios-users at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nagios-users
> ::: Please include Nagios version, plugin version (-v) and OS 
> when reporting any issue. 
> ::: Messages without supporting info will risk being sent to /dev/null
> 


-------------------------------------------------------
This SF.net email is sponsored by: ValueWeb: 
Dedicated Hosting for just $79/mo with 500 GB of bandwidth! 
No other company gives more support or power for your dedicated server
http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null