| |||||||||||||
Logcheck compatibilityLogcheck compatibilityPosted Jan 27, 2011 9:55 UTC (Thu) by walles (guest, #954)Parent article: Correlating log messages with syslog-ng
Hi!
Logcheck comes with a ton of regexps for stuff that one would expect to find in ones logs.
How much work would it be to get syslog-ng to put all messages not matching any of the logcheck regexps in a separate log file?
Currently, logcheck is using egrep to scan the logs, and egrep's performance is poor:
Being able to replace the logcheck daemon and just use its regexp database would be nice!
Regards /Johan
(Log in to post comments)
Logcheck compatibility Posted Jan 28, 2011 17:20 UTC (Fri) by nix (subscriber, #2304) [Link]
The initial pattern database was constructed by taking logcheck (and, IIRC, a few other similar programs) and turning them into syslog-ng patterns. So this is already done.
|
|||||||||||||