Correlating log messages with syslog-ng

They all tend to be "permissive" - ie. they only check for things they know to check for - and thus doesn't catch the odd log entries, which are often the ones you'd particularly want to know about (and can't match for as the events are seldom and you don't know how they look exactly, unless you ensure to check the sourcecode for each version of all software you're running).

To solve it for me, I added a small feature to swatch (so it starts a logfile from where it was last - so you can scan the same file every minute, and only get new events) - and wrote swatch rules for each logfile (so it only checks the one relevant for this logfile - and outputs all that wasn't specificly discarded.

I wrote about it on my blog, and posted the rewritten swatch: http://blog.klavsen.info/content/1-way-do-proper-log-moni...