Re: Central Reporting/Monitoring

[David Douthitt]

On Thursday, June 12, 2003, at 10:32  AM, Chip Seraphine wrote:

> Syslog seems pretty reasonable, although not everything you might want 
> goes thru there.
>
> In my environment, I patched cfengine to use the "local1" facility (to 
> seperate cfengine messages from other noise) and dump local1 to a 
> specific file (/var/log/cfengine.log).  I then run swatch against that 
> log file and have swatch report certain strings or any message that 
> went at the .err priority or higher.

You could also use syslog-ng to sort based on the name or source or a 
pattern in the syslog message.

I think that sounds like a good idea... I'm going to try it myself :-)  
I already use syslog-ng to sort syslog messages nicely...