Re: important errors to control with swatch

I'm also extremely interested in expanding my log watching to include a 
massive amount of comprehensive pattern matching alerting.

I currently have some but need to expand it. The problem is that this is 
really a difficult thing to approach because it can only catch known 
patterns in this fashion. And whitelisting is really not practical in 
this context as the logs generated are practically infinite and not 
really able to whitelist them.

I think that there should really be a well maintained project of regexs 
for this purpose, one official champion for us to build our baselines 
on... with frequent updates...

Anyone got any ideas or regexs they want to share?

Isaac, you would do well to have things like "I/O Error" for disk 
problems... "hardware hung"... etc etc, but this list is practically 
endless, you should look at your logs and decide which ones you'd like 
to be alerted on.

-h

Hari Sekhon



Isaac Perez Moncho wrote:
> Hello,
> I just installed swatch, and used this configuration file for the
> checks:
> http://www.loganalysis.org/sections/signatures/log-swatch-skendrick.txt
>
> Anyone knows any other common phrase or word that I should find the logs
> for hardware and system errors?
> Or what you consider important to monitor in the logs?
> Thanks
>
>