lgcheckd.cfg

NAME

SYNOPSIS

AVAILABILITY

DESCRIPTION

The lgcheckd daemon can compute the configuration file edrc/etc/logcheckd.cfg of the logcheckd (1m) command for easy effortless migration (see also: USE_LEGACY_COMMAND=False in logcheckd.cfg(4)).

However, the lgcheckd command computes only the options as documented in this manual page.

FILEFORMAT

The fileformat for the 'GENERAL OPTIONS' is OPTION=VALUE

Between the OPTION, the = and the VALUE are no spaces.

You should not comment out any OPTION If you like to use default settings simply do not specify a VALUE.

For the 'LOGFILES OPTIONS', the fileformat is field ; field ; field ; field ; field ; field ; (ensure, that between the field and the separator ; are no spaces).

OPTIONS

GENERAL OPTIONS

ALERT_MAIL_TO

Recipient of the alert mail. Multiple recipients have to be specified as a comma separated list. If no ALERT_MAIL_TO is set, there is no alert mail sent on filesystem shortage and on resumption of log collection.

Example: ALERT_MAIL_TO=fred.flintstone@acme.ch,support@acme.ch

Default: ALERT_MAIL_TO=""

COLLECT

If this setting is set to True the log match data collection is enabled on startup and the matches are saved to the state.db for later analysis and reporting, if set to False log match data collection is disabled.

Be aware, that command line definitions using lgcheckd -a [no]collect has preference.

Example: COLLECT=False

Default: COLLECT=True

INTERFACESTART

If this setting is set to True the interfaces defined in the INTERFACES=... definition are started on positive match, when set to False the interfaces are not started on positive match.

Be aware, that command line definitions using lgcheckd -a [no]ifstart has preference.

Example: INTERFACESTART=False

Default: INTERFACESTART=True

CLEAN_COLLECT

If this setting is set to True the collected logfile match data is removed after report creation. However, the match count information is retained.

Example: CLEAN_COLLECT=False

Default: CLEAN_COLLECT=True

REPORTDIR

Directory where the 'Log File Check' reports are written to. If you specify a relative path name the path is relative to the root of the WA2L/edrc installation.

Example: REPORTDIR=/dat/report/ACME/LOGCHECK

Example: REPORTDIR=var/www/report/rpt/007/ACME/LOGCHECK

Default: REPORTDIR=var/logcheckd/report

INTERFACES

Interfaces to be executed when a certain check level matches. The setting is a space separated list of entries in the format: <interface>:<LEVEL1>,<LEVEL2>

Example: INTERFACES="mail:HIGH CAUnicenter:HIGH,MEDIUM"

Default: INTERFACES=""

SUSPENDTRIGGER

If the free space of the file system on which the state.db resides is lower then

  'size of state.db' * SUSPENDTRIGGER

the collection of log file matches is suspended.

Example: SUSPENDTRIGGER=5

Default: SUSPENDTRIGGER=20

LOGFILES OPTIONS

It is not needed to restart the lgcheckd when logfile entries are added.

Pattern files can be added and modified during lgcheckd runtime.

In all other cases the lgcheckd needs to be restarted.

The format of the logfiles specification is:

resolve_mode ; patternfile ; interfaces ; res ; res ; logfile ;

(ensure, that between the field and the separator ; are no spaces)

where the fields have the following content:

resolve_mode

the resolve mode needs to be set to eval or dflt.

However, it makes no difference in how the entries are computed, the resolve_mode field exists to be backward compatible to the configuration file for the logcheckd(1m) command.

patternfile

pattern file. The pattern files are located in the var/logcheckd/pattern directory. If an operating system dependent pattern file with the name <patternfile>.<OSID> exists (e.g. Cron.Solaris ), this file will be used for logfile analysis, else the pattern file as specified (e.g. Cron ) will be used.

interfaces

Interfaces to be executed when a certain check level matches for a certain logfile. The setting is a space separated list of entries in the format: <interface>:<LEVEL1>,<LEVEL2>. If the interfaces column is set for a logfile, the setting in the INTERFACES option is ignored for that logfile.

res

reserved for future use, leave it empty.

logfile

logfile to analyze.

In general the logfile has to be specified with an absolute path name.

However, if a relative path is specified, it is relative to the root of the WA2L/edrc installation (as returned by the approot(3) command).

Example:

dflt;WA2Ledrc;;;;var/log/edrc.log;
dflt;lgcheckd;;;;var/log/lgcheckd.log;
dflt;All;;;;/etc/rc.log;
eval;MCSG;;;;/etc/cmcluster/*/*.cntl.log;
dflt;sudo;;;;/var/adm/sudo.log;
dflt;Samba;;;;/var/opt/samba/log.smbd;
dflt;syslog;;;;/var/adm/syslog/syslog.log;

FILES

var/samples/templates/lgcheck.cfg

Template configuration file for lgcheckd.

EXAMPLES

SEE ALSO

NOTES

BUGS

AUTHOR

COPYRIGHT

This is free software; see edrc/doc/COPYING for copying conditions. There is ABSOLUTELY NO WARRANTY; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.