[ILUG] syslog analyser/parser

[Justin Mason]

James Raftery said:

> On Thu, Jun 22, 2000 at 06:44:22PM +0100, Paul Jakma wrote:
> > anyone know of a good syslog analyser/parser. something that'd watch for
> > possible problems, etc.. do any kind of fancy stuff at all.
> 
> swatch: http://www.stanford.edu/~atkins/swatch/

The Perl distro also has a good one, but it may not be portable anymore;
it would be run from cron, grep out all the "normal" messages, and mail
you the "abnormal" ones.  It was great (but only ran once a day so not
good for watching active, realtime logs).

I've reimplemented it BTW so if you fancy that, mail me...

--j.