System Log Analysis - Revision history

128.111.236.79 at 22:31, 29 September 2010

2010-09-29T22:31:11Z

128.111.236.79 at 22:27, 29 September 2010

2010-09-29T22:27:42Z

128.111.236.79 at 22:27, 29 September 2010

2010-09-29T22:27:12Z

128.111.236.79 at 22:19, 29 September 2010

2010-09-29T22:19:55Z

128.111.236.79 at 22:19, 29 September 2010

2010-09-29T22:19:23Z

128.111.236.79 at 22:18, 29 September 2010

2010-09-29T22:18:42Z

128.111.236.79 at 22:17, 29 September 2010

2010-09-29T22:17:53Z

128.111.236.79 at 22:17, 29 September 2010

2010-09-29T22:17:11Z

128.111.236.79 at 22:15, 29 September 2010

2010-09-29T22:15:28Z

128.111.236.79 at 22:14, 29 September 2010

2010-09-29T22:14:23Z

@@ Line 3: / Line 3: @@
 (Here are the steps to perform the log analysis for ‘'''slate'''’ and ‘'''quake'''’ and ''''ics'''')<br /><br />
-NOTE: the log files that need analyzing are cleared and renewed each month<br />
+'''NOTE''': the log files that need analyzing are cleared and renewed each month<br />
-NOTE2: log analysis procedures for quake and ics are the same as for slate<br />
+'''NOTE2''': log analysis procedures for '''quake''' and '''ics''' are the same as for slate<br />
-NOTE3: a star (*) means fill in the blank<br /><br />
+'''NOTE3''': a star (*) means fill in the blank<br /><br />
 #  Open a new terminal session.  The terminal can be found in the quick link bar at the bottom of the MacOS X screen.

@@ Line 80: / Line 80: @@
 ----
-Mark Gorecki
+Mark Gorecki<br />
-modified by Joe Mount 2006-02-21
+modified by Joe Mount 2006-02-21<br />
-modified by Robert Dame 2006-06-02
+modified by Robert Dame 2006-06-02<br />
-modified by Kurt Olsson 2006-10-19
+modified by Kurt Olsson 2006-10-19<br />

@@ Line 51: / Line 51: @@
 = Manual New Month Procedure =
-This must be done before you do the first log analysis of each month.
+This must be done before you do the first log analysis of each month.<br /><br />
-Some of the log files are updated monthly, while some run continuously. Because of this, the -nm tag is not enough to update the logs each month. Here is a list of the log files that update monthly (all others are continuous). The rule of thumb is that any log file that ends in .log is updated monthly, but his is not necessarily the case.
+Some of the log files are updated monthly, while some run continuously. Because of this, the -nm tag is not enough to update the logs each month. Here is a list of the log files that update monthly (all others are continuous). The rule of thumb is that any log file that ends in .log is updated monthly, but his is not necessarily the case.<br /><br />
-qlogs:
+qlogs:<br />
-horde.log
+horde.log<br />
-rsync.log
+rsync.log<br />
-xfer.log
+xfer.log<br /><br />
-slogs:
+slogs:<br />
-All files are continuous, so simply do not run -nm, The rest of the procedure only refers to the qlogs and ilogs.
+All files are continuous, so simply do not run -nm, The rest of the procedure only refers to the qlogs and ilogs.<br /><br />
-ilogs:
+ilogs:<br />
-maillist-autolistupdate.log
+maillist-autolistupdate.log<br />
-rsyncd.log
+rsyncd.log<br />
-spamtraining.log
+spamtraining.log<br />
-watchdog.log
+watchdog.log<br /><br />
-.  In order to ensure that all the files work properly, go to *conf/ and use the more command to find the current line number for all of the above files. Make a note of these line numbers.
+# In order to ensure that all the files work properly, go to *conf/ and use the more command to find the current line number for all of the above files. Make a note of these line numbers.
+# Run *autolog -nm.
-.  Run *autolog -nm.
+# Go back to *conf/ and edit the conf files for the above logs. These files will have been reset to zero, simply change this line number to the line number you wrote down.<br /><br />
 Mark Gorecki
 modified by Joe Mount 2006-02-21
 modified by Robert Dame 2006-06-02
 modified by Kurt Olsson 2006-10-19

@@ Line 45: / Line 45: @@
 #* the *.uniq files are the files that need to be analyzed and reported
 # send Aaron an email detailing any entries of interest with the appropriate subject header (like "slate log analysis results") <br /><br />
-#: Do this for each machine's log entries of interest.  I (RD) will write one email that includes all entries of interest.

@@ Line 44: / Line 44: @@
 # analyze log.out.uniq files using more
 #* the *.uniq files are the files that need to be analyzed and reported
-# send Aaron an email detailing any entries of interest with the appropriate subject header (like "slate log analysis results") <br />
+# send Aaron an email detailing any entries of interest with the appropriate subject header (like "slate log analysis results") <br /><br />
 #: Do this for each machine's log entries of interest.  I (RD) will write one email that includes all entries of interest.

@@ Line 1: / Line 1: @@
 =SYSTEM LOG ANALYSIS PROCEDURES: =
-<br />(Here are the steps to perform the log analysis for ‘'''slate'''’ and ‘'''quake'''’ and ''''ics'''')<br /><br />
+(Here are the steps to perform the log analysis for ‘'''slate'''’ and ‘'''quake'''’ and ''''ics'''')<br /><br />
 NOTE: the log files that need analyzing are cleared and renewed each month<br />
@@ Line 27: / Line 27: @@
 #: sautolog - log analysis for the slate machine<br />
 #: iautolog - log analysis for the ics machine<br /><br />
-#: with optional flags  *autolog [-h]<br /><br />
+#: with optional flags  *autolog [-h]<br />
 #* for list of options and usage (AS OF 2006-02, THE LOG FILES THAT ARE COPIED DO NOT GET REPLACED EACH MONTH, SO DO NOT USE THE -NM FLAG!!!!!!!!!!!!! - you can verify this by opening the log files and checking the dates) <br />
 #* NOTE: use the –nm flag to reset the line counters used by logsurfer when analyzing logs of a new month for the first time. Or you can delete all files (EXCEPT default.ls) from the *conf/ directory.

@@ Line 40: / Line 40: @@
 #* to make this process faster, open another terminal, log into fablio, go to the loganalysis/ directory, and follow steps 12-14
 # cd into *results/ and run 'suniqall' (see documentation for more info)
-#: NOTE: before using 'suniqall', the suniq script must be in
+#: NOTE: before using 'suniqall', the suniq script must be in <br /> /space/stadm/loganalysis (see step #3).
 #* make sure that *results/ contains another directory old_results/ and that this directory has permissions of "drwxr-xr-x" ('ls -l' to check)
+# analyze log.out.uniq files using more
-. analyze log.out.uniq files using more
+#* the *.uniq files are the files that need to be analyzed and reported
 . send Aaron an email detailing any entries of interest with the appropriate subject header (like "slate log analysis results")

@@ Line 29: / Line 29: @@
 #: with optional flags  *autolog [-h]<br /><br />
 #* for list of options and usage (AS OF 2006-02, THE LOG FILES THAT ARE COPIED DO NOT GET REPLACED EACH MONTH, SO DO NOT USE THE -NM FLAG!!!!!!!!!!!!! - you can verify this by opening the log files and checking the dates) <br />
-#: NOTE: use the –nm flag to reset the line counters used by logsurfer when analyzing logs of a new month for the first time. Or you can delete all files (EXCEPT default.ls) from the *conf/ directory.
+#* NOTE: use the –nm flag to reset the line counters used by logsurfer when analyzing logs of a new month for the first time. Or you can delete all files (EXCEPT default.ls) from the *conf/ directory.
-#: NOTE2: useful flags are -d and -wr (see documentation or use '*autolog -h' ) (if you use these flags, you can skip step 14)<br />
+#* NOTE2: useful flags are -d and -wr (see documentation or use '*autolog -h' ) (if you use these flags, you can skip step 14)<br />
 # choose log # to analyze.
 #* the script will prompt you