安装:
perl Makefile.PL
make
make test
make install
配置:
.swatchrc
watchfor / / 监控设定字段
echo[=mode] 输出报刊匹配模式的行,缺省为normal。
bell[=n] 在终端振铃n次
mail[=address:address:…] 指定邮件发送的email地址,多个地址间用"":"隔开
throttle=options 限制匹配行的动作。
exec=command 模式匹配时,执行command命令。
配置文件示例如下:
watchfor /ftp/
echo red
mail addresses=xhl\@company.com,subject=Syslog Monitor Alert
watchfor /eth/
echo red
mail addresses=xhl\@company.com,subject=Syslog Monitor Alert
watchfor /error/
echo red
mail addresses=xhl\@company.com,subject=Syslog Monitor Alert
watchfor /failed/
echo red
mail addresses=xhl\@company.com,subject=Syslog Monitor Alert
watchfor /file system full/
echo red
mail addresses=xhl\@company.com,subject=Syslog Monitor Alert
watchfor /vmunix/
echo red
mail addresses=xhl\@company.com,subject=Syslog Monitor Alert
# Kernel problems or system reboots
watchfor /panic|halt/
echo red
mail addresses=xhl\@company.com,subject=Syslog Monitor Alert
执行:
swatch -c ~/.swatchrc -t /var/log/messages
e4node1:~ # swatch -c ~/.swatchrc -t /var/log/messages
*** swatch version 3.1.1 (pid:17163) started at Wed Mar 19 15:20:16 CST 2008
Mar 19 17:13:47 e4node1 kernel: cdrom: open failed.
Mar 19 17:13:47 e4node1 kernel: cdrom: open failed.
Mar 19 17:13:47 e4node1 kernel: end_request: I/O error, dev fd0, sector 0
Mar 19 17:13:47 e4node1 kernel: end_request: I/O error, dev fd0, sector 0
Mar 19 17:13:47 e4node1 kernel: end_request: I/O error, dev fd0, sector 0
Swatch是一个很好的日志文件管理工具,它能确实的保证你的日志文件的完整性,配合syslog server 一起用,可实时的监控你所管理的各台机器系统的问题。
来自 “ ITPUB博客 ” ,链接:http://blog.itpub.net/308563/viewspace-206234/,如需转载,请注明出处,否则将追究法律责任。
转载于:http://blog.itpub.net/308563/viewspace-206234/