Re: [SLE] logdigest email reports stopped
* Leendert Meyer
I put the following line in ignore.local:
: removed$
The next manual run of logdigest did not generate an email.
The condition of sending a mail is:
1) The filesize of the file to be mailed must be greater than 0 2) FOUND must be 1
FOUND is set to 1 on 3 occasions 1) if grepping using alarming{,.local} results in a non-empty file 2) if grepping using ignore{,.local} results in a non-empty file 3) if EXTENDED_STATS is yes
To at least generate a mail, set EXTENDED_STATS="yes" in /etc/logdigest/config.
OK, ran *many* tests each with slightly differing conditions and seemingly random results, but stumbled upon the answer. Logdigest will not function correctly with more than one *blank* line at the end of one of the condition files under /etc/logdigest. I did not test each file, but noticed the condition with ignore.local. I would *assume* (key word that 'assume') that the actions are similar for each of the condition files. 8^) are we up to a case yet? note: posted to suse-linux-e -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/photos
On Sunday 11 July 2004 15:49, Patrick Shanahan wrote:
* Leendert Meyer
[07-11-04 06:59]: I put the following line in ignore.local: : removed$
The next manual run of logdigest did not generate an email.
The condition of sending a mail is:
1) The filesize of the file to be mailed must be greater than 0 2) FOUND must be 1
FOUND is set to 1 on 3 occasions 1) if grepping using alarming{,.local} results in a non-empty file 2) if grepping using ignore{,.local} results in a non-empty file 3) if EXTENDED_STATS is yes
To at least generate a mail, set EXTENDED_STATS="yes" in /etc/logdigest/config.
OK, ran *many* tests each with slightly differing conditions and seemingly random results, but stumbled upon the answer.
Logdigest will not function correctly with more than one *blank* line at the end of one of the condition files under /etc/logdigest. I did not test each file, but noticed the condition with ignore.local. I would *assume* (key word that 'assume') that the actions are similar for each of the condition files.
8^) are we up to a case yet?
Although it's new to me, this is old news: diff -rU 0 logdigest-0.1.3/README logdigest-0.1.4/README --- logdigest-0.1.3/README 2003-07-23 04:02:27.000000000 +0200 +++ logdigest-0.1.4/README 2003-09-01 11:13:27.000000000 +0200 @@ -14,0 +15,17 @@ + +Configuration: + +For the regular expressions (that constitute the "filter rules"), +edit /etc/logdigest/ignore.local (a file that is empty in the beginning). + +See /etc/logdigest/ignore for examples. The character '.' is an arbitrary +character, the characters (|)[] have special meaning unless escaped with '\', +and so on. + +For testing, you can simply use +grep -f /etc/logdigest/ignore.local /var/log/messages +(or grep -v -f for the negative match). + +Note: /etc/logdigest/ignore.local must not contain emty lines! + + Nice to have it confirmed though. ;)) Geeezzz... Cheers, Leen
On Sun, Jul 11, 2004 at 08:49:29AM -0500, Patrick Shanahan wrote:
OK, ran *many* tests each with slightly differing conditions and seemingly random results, but stumbled upon the answer.
Logdigest will not function correctly with more than one *blank* line at the end of one of the condition files under /etc/logdigest. I did not test each file, but noticed the condition with ignore.local. I would *assume* (key word that 'assume') that the actions are similar for each of the condition files.
This should be covered in the README, really. Better, logdigest should check for empty lines and issue a warning or ignore them. I'll make sure to fix it in the next version. BTW, you can simply delete the /var/lib/logdigest/*.offset files to force a re-run on the entire files. Thanks, Peter
participants (3)
-
Leendert Meyer
-
Patrick Shanahan
-
poeml@cmdline.net