swatch vs. logwatch (vs. syslog-ng? something?)

[Dave Burns]

What do you guys use to make sure that evil log messages get noticed quickly?

I've been trying to set up swatch. There is an rpm to install the
binary, but it does not provide a default config file or set up swatch
as a service in chkconfig. So I am doing it myself, no problem. But I
keep googling for various things, and if I include 'fedora' in the
search terms I don't get much, as if no one used it. Swatch has been
around a long time, so if anyone used it I think there would be a lot
more information available and stuff ready to go.

The basic capability I am looking for is a daemon that tails one (or
more) log files, greps out stuff that is boring, and immediately sends
me an email about the interesting stuff. Especially stuff that I've
never seen before and therefore don't have a nice regular expression
for other than /./. Swatch seems aimed right at this sort of problem.

Logwatch is similar,  but by default is set up to run once a day, and
includes a lot of stuff by default that I consider dull, and even the
stuff that I consider interesting is formatted in a way that makes me
have to think too much before knowing "everything's cool" or "oh
fudge!" Is there an easy way to make it more event driven and grep out
all the boilerplate? Do you leave logwatch's setup alone, turn it off,
or tweak it?

I know nothing about syslog-ng, other than it handles centralized
logging over TCP, maybe it can so something like this, grep out the
noise and email the signal? Any other options?

My feeling is that I should only have to look at logs when I am
looking for error messages related to some problem I am having, that
the sort of bad news that shows up in a log file unexpectedly should
come chasing after me (via email)  instead of waiting for me to come
take a look at the logs, something I am always tempted to put off for
'later'.

Thanks,
Dave

[John Horne]

On Fri, 2007-11-02 at 21:48 -1000, Dave Burns wrote:
>  The basic capability I am looking for is a daemon that tails one (or
>  more) log files, greps out stuff that is boring, and immediately sends
>  me an email about the interesting stuff. Especially stuff that I've
>  never seen before and therefore don't have a nice regular expression
>  for other than /./. Swatch seems aimed right at this sort of problem.
>   
Hi,

We use swatch for monitoring about 20 or so (Fedora) PC's and (CentOS)
servers. Swatch will do what you want above, but as you have already
noticed it's not really a complete package. I had to set up config files
for the log files I wanted watched, and then write a startup script to
start swatch watching the log files at boot time. Okay, I only really
had to do this once, several years ago, and we have used the same
scripts since then. (I notice on the SourceForge site that there is
still a feature request for a startup script.)

I don't use the email facility of swatch, but get it (using 'exec') to
run an in-house script which sends a notification to our Big Brother
monitoring system (http://bb4.org/download.html). That way we have a
single web interface to let me know if anything is going wrong with our
systems (BB monitors other things such as disk space, cpu usage,
connectivity, services are running etc, etc).

The help public forum on the swatch sourceforge site seems to be
reasonably active, and it's nice to see the swatch author replying there
too. For a while (a few years ago) the program support seemed to fizzle
out, and this may be why you found little about swatch on google.
However, the author then moved the project to SourceForge, and it seems
to have picked up support since then.

Overall I have had no problems running swatch. Like you I wanted
something that notified me immediately that something happened, rather
than just being emailed once a day (with logwatch). To me that's a bit
too late to be told that someone has done, or is trying to do something,
to my systems!


John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: [phone]
E-mail: John.Horne(a)plymouth.ac.uk       Fax: [phone]