How can I split a log file into several log files?

How can I split a log file into several log files?

Post by Don Smit » Tue, 10 Oct 2000 04:00:00



Hello, I need to setup a log server.  This in itself is no problem, but if I
have several different systems
logging to one system and one logfile it makes it kind of hard to scan
through.
On the log server, there is the syslog file which contains several different
systems logs.
I'm trying to get something like:
syslog_system1
syslog_system2
syslog_system3
etc...
Does anyone know of a utility or script that could perform this for me?
Or is there something in syslog.conf I can do?
Thanks very much!
Don
 
 
 

How can I split a log file into several log files?

Post by DaveBoot » Tue, 10 Oct 2000 04:00:00




Quote:> Hello, I need to setup a log server.  This in itself is no problem,
but if I
> have several different systems
> logging to one system and one logfile it makes it kind of hard to scan
> through.
> On the log server, there is the syslog file which contains several
different
> systems logs.
> I'm trying to get something like:
> syslog_system1
> syslog_system2
> syslog_system3
> etc...
> Does anyone know of a utility or script that could perform this for
me?
> Or is there something in syslog.conf I can do?

You'll not get too far with syslog.conf, methinks, as it doesnt select
on where the message came from only on its facility/severity. As for
postprocessing your logfiles to split them into different places based
on the host logging the message it should be a relatively trivial piece
of scripting...

something like
for i in list-of-hostnames ; do
  grep $i syslog > syslog_$i
done

Although you might want to be a little more creative to avoid
references to a hostname within a log message (as opposed to at its
start immediately after the timestamp) triggering it too.

Of course if you wanted to be more elegant you could use perl, hash up
references to filehandles based on hostnames and open them for
appending on the first log entry from that host, doing all of your
separate logfiles in a single pass, you could make it do sensible
things with command-line params to let you be even more selective etc
etc etc...

Dave.

--
Sticking your head in the sand gains you nothing...
Apart from grit up your nose.

Sent via Deja.com http://www.deja.com/
Before you buy.

 
 
 

How can I split a log file into several log files?

Post by Peter Sundstro » Wed, 11 Oct 2000 05:50:15



Quote:> Hello, I need to setup a log server.  This in itself is no problem, but if
I
> have several different systems
> logging to one system and one logfile it makes it kind of hard to scan
> through.
> On the log server, there is the syslog file which contains several
different
> systems logs.
> I'm trying to get something like:
> syslog_system1
> syslog_system2
> syslog_system3
> etc...
> Does anyone know of a utility or script that could perform this for me?
> Or is there something in syslog.conf I can do?
> Thanks very much!
> Don

The usual way of configuring a log server is to having everything logging to
a single log and then using tools like logsurfer, swatch etc to split/sort
the files or perform various actions depending on matching patterns.