Topic: Notification of specific log entries

[AJB]

Hi all,

Not sure I'm posting this in the right forum; if not, let me know. My question is basically how to configure email alerts in case a specific entry gets written into the log.

The situation: I'm using a Compaq Proliant 1600 configured with hardware RAID5 using a Smart Array 3200 Controller and running SME 7.2. When one of the discs fails, the line

Code: [Select]

[date/time] [hostname] kernel: Non Fatal error on ida/c0d0
is written into the Messages log file. And while I can manually check for occurence of this entry, it would be neat if the admin would receive an email notification whenever this entry is written into the log.

I have installed LogWatch in my attempts to get this working, but the default LogWatch-config does not include the entry in its notification mail. Adjusting the Detail level to 10 did not help either.

Could anyone help me with getting this to work, either with or without LogWatch? Oh, and I have been somewhat of a Windows guy till now and I usually administer my SME box through the server manager. So although I'm not exactly afraid of the cli, I'm not all that comfortable with it either. A step-by-step approach would therefore be highly appreciated

[CharlieBrady]

Not sure I'm posting this in the right forum; if not, let me know. My question is basically how to configure email alerts in case a specific entry gets written into the log.

SME server has no feature for configuring email alterts base on log entries.

I see you have installed LogWatch. I expect that can do the job for you if configured correctly. Correct configuration of LogWatch, however, is off-topic for this forum.

[AJB]

I see. Any chance that such functionality might be included in future releases of SME Server? It seems quite useful to me, but I am somewhat biased of course...

[cactus]

I see. Any chance that such functionality might be included in future releases of SME Server? It seems quite useful to me, but I am somewhat biased of course...

If you would like it considered for future releases you should add it as a New Feature Request in the bugtracker.

[brianr]

suggest you go to here, you may find what you want.

http://www2.logwatch.org:81/tabs/docs/HOWTO-Customize-LogWatch.html

[Stefano]

hi

a simple script such as

Code: [Select]

#/bin/sh

DATE=`date -d yesterday +"%b %e"`

grep "$DATE" /var/log/messages | grep -i 'non fatal error'

in etc/cron.daily will send you an email if an error occurred

probably you'd better to put in /etc/cron.d and run BEFORE cron.daily, because of logs rotation.

HTH

ciao
Stefano

[AJB]

Thanks!

I'm not using your exact script as it did not entirely work (probably because I've been fooling around with the date on my test box for various reasons which likely screwed up the logs), but once Google taught me the basics of your script, I downgraded it to a simple grep through /var/log/messages which also does the trick. I should really get into scripting and all sorts of other non-gui stuff myself .

[byte]

Moving this topic to the SME 7.x contribs forum, it is more appropriate there. Thanks!

[AJB]

Not sure if I'm supposed to second-guess the moderating team in the thread itself, but it seems to me that this thread is not related to any contrib. My attempts to set this up started with LogWatch, but as it is I managed to configure notifications without it, using only a bash script and cron.

Don't mean to offend anyone, so please remove this post if not appropriate.