[Nagiosplug-devel] Re: Rewrite of check_log
Paul L. Allen
pla at softflare.com
Wed Feb 25 18:42:01 CET 2004
Flo Gleixner writes:
> I did a half-rewrite of the check_log script.
Good. Both check_log and check_log2 are seriously flawed (in my
opinion). They do NOT scale well for large logs. My PHB writes
stuff that deals with logs and scales badly too, and I beat him over the
head when it all falls apart and one of our boxes goes into terminal
CPU overload because of his crude approach to dealing with log events.
> - No more diff. It calculates the difference with the difference of the
> filesizes and only greps the added lines. This implies:
> - greatly increased performance for large log files.
Good. So what happens when logrotate kicks in? I think a check_log
replacement has to retain state: how far it got into the logfile and
the inode of the logfile (so it can know if the file has been rotated).
I haven't examined the problem very deeply because right now I don't
have a need to use check_log. But those are the two biggest problems
that occurred to me when I looked at check_log and check_log2 (sorry,
Ethan, those two just don't come even close to being sensible if I wanted
to monitor any of our logs - typical maillog size is 40M/day and a "scan
right the way through to get the latest entry" approach just doesn't
cut it.)
--
Paul Allen
Softflare Support
More information about the Devel
mailing list