|
Hello,
Sorry to interfere with your business, guys, but ...
I belive you need to sort the entries by date .. most log analyzers expect
this..
Easy enough:
cat error_log* | sort -r > error_log.all
I'm not convinced. This will not sort entries by date. Imagine following
two (fictive, but syntactically and semantically correct) error_logs:
# cat error_log.1
[Thu Dec 4 03:47:24 2002] [notice] Apache/1.3.27 (Unix) mod_jk/1.2.2
mod_perl/1.27 PHP/4.3.1 mod_ssl/2.8.14 OpenSSL/0.9.7a configured --
resuming normal operations
[Thu Mar 27 03:47:24 2003] [notice] Apache/1.3.27 (Unix) mod_jk/1.2.2
mod_perl/1.27 PHP/4.3.1 mod_ssl/2.8.14 OpenSSL/0.9.7a configured --
resuming normal operations
# cat error_log.2
[Sun Jan 19 06:57:41 2003] [error] [client 4.65.71.160] File does not
exist:
/var/www/htdocs/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Thu Apr 20 03:47:24 2003] [notice] Apache/1.3.27 (Unix) mod_jk/1.2.2
mod_perl/1.27 PHP/4.3.1 mod_ssl/2.8.14 OpenSSL/0.9.7a configured --
resuming normal operations
Your pipeline does not sort them in a correct way (entries by date) at
all. IMHO it's not so easy to script ;).
# cat error_log.* | sort -r
[Thu Mar 27 03:47:24 2003] [notice] Apache/1.3.27 (Unix) mod_jk/1.2.2
mod_perl/1.27 PHP/4.3.1 mod_ssl/2.8.14 OpenSSL/0.9.7a configured --
resuming normal operations
[Thu Dec 4 03:47:24 2002] [notice] Apache/1.3.27 (Unix) mod_jk/1.2.2
mod_perl/1.27 PHP/4.3.1 mod_ssl/2.8.14 OpenSSL/0.9.7a configured --
resuming normal operations
[Thu Apr 20 03:47:24 2003] [notice] Apache/1.3.27 (Unix) mod_jk/1.2.2
mod_perl/1.27 PHP/4.3.1 mod_ssl/2.8.14 OpenSSL/0.9.7a configured --
resuming normal operations
[Sun Jan 19 06:57:41 2003] [error] [client 4.65.71.160] File does not
exist:
/var/www/htdocs/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
To me the best solution is still to either write all error_logs into the
same file or to configure httpd.conf in a way that the logs are sent via
the syslog() interface.
Then you use syslog-ng to do all the needed logics, data handling,
merging, correlation and event triggering.
Of course, the possibility of me not understanding the real problem
could be an issue here too, as noone else has complained about this
solution yet and I already had a pretty long day today.
Best regards,
Roberto Nibali, ratz
--
echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq'|dc
|
