Tina, We have something similar to this... If our syslog-ng/custom perl code we have a list of machines that should be reporting everyday (even to say that nothing has changed). If they don't report than that comes up as an error/warning. I'd imagine that it would be pretty trivial to do the same for actual message content. HTH, Harry Quoting Tina Bird <tbird@precision-guesswork.com>: *> may still be interesting. *> *> anyone out there have a tool that can parse syslog data (or anything text *> based, i guess) and send an alert if a particular message does >not< show *> up? *> *> thanks -- tbird *> *> "Our duty, as living things, is to be sure that pain is not our whole *> story, for we can choose to be otherwise....we can choose to dance." *> -- from "Six Moon Dance," by Sheri Tepper *> *> http://www.shmoo.com/~tbird *> Log Analysis http://www.loganalysis.org *> VPN http://vpn.shmoo.com *> *> _______________________________________________ *> LogAnalysis mailing list *> LogAnalysisat_private *> http://lists.shmoo.com/mailman/listinfo/loganalysis *> -- Harry Hoffman ITSS Systems Team Leader University of Auckland hhoffmanat_private hhoffman@ip-solutions.net STANDARD DISCLAIMER: ********************************************** *This universe shipped by weight, not volume.* *Some expansion may have occured in shipping.* ********************************************* ------------------------------------------------- This mail sent through IMP: http://horde.org/imp/ _______________________________________________ LogAnalysis mailing list LogAnalysisat_private http://lists.shmoo.com/mailman/listinfo/loganalysis
This archive was generated by hypermail 2b30 : Sun Dec 15 2002 - 23:26:28 PST