Thanks Risto.
Please do find my comments inline.
-Ashok
-----Original Message-----
From: Risto Vaarandi [mailto:[email protected]]
Sent: Thursday, February 02, 2012 2:43 AM
To: [email protected]
Subject: Re: [Simple-evcorr-users] Scanning the logs using SEC
On 02/01/2012 11:22 PM, [email protected] wrote:
> Hello Team,
>
> We are planning to use this tool to triage and debug in our product. But
> we do have few queries. Can you please clarify it?
>
> 1. Is it possible to use SEC to scan for specific pattern from a group
> of log files? I do noticed that is used as an pre-emptive tool, I just
> want to know whether it can be used as after-the-fact tool?
If you mean finding patterns from log files that have already been
created, the answer is yes -- you have to use --notail option for this.
Note, however, that a number of SEC's advanced event correlation
features would not make sense in this particular context, since they
work for real-time events only.
[Ashok Vairavan] Does the following rule set works with --notaill option.
type=EventGroup4
ptype=regexp
pattern=A stopped
ptype2=regexp
pattern2=B stopped
ptype3=regexp
pattern3= C stopped running
cont=write -"Done C"
ptype4=regexp
Pattern4=Done D
Action=write - "Done D"
window=120
>
> 2. Does it listens to only one file or group of files? Can it monitor
> bunch of files?
yes, you can monitor arbitrary number of files.
>
> 3. If there are umpteen number of logfiles? What would be the
> performance bootleneck?
If you would be processing already created log files with --notail
option, then there wouldn't be much CPU time spent for needless
overhead. However, if you are monitoring a very large number of files in
real time, file status polling can consume quite some resources.
Fortunately, if many of the files do not change frequently (e.g., new
data are added once a minute or even less frequently), you can employ
the --check-timeout option for reducing resource consumption. For
example, using --check-timeout=10 will skip a status poll for a file for
10 seconds, if it has not been modified.
kind regards,
risto
>
> Thanks,
>
> Ashok
>
>
>
> ------------------------------------------------------------------------------
> Keep Your Developer Skills Current with LearnDevNow!
> The most comprehensive online learning library for Microsoft developers
> is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
> Metro Style Apps, more. Free future releases when you subscribe now!
> http://p.sf.net/sfu/learndevnow-d2d
>
>
>
> _______________________________________________
> Simple-evcorr-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
------------------------------------------------------------------------------
Keep Your Developer Skills Current with LearnDevNow!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-d2d
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
------------------------------------------------------------------------------
Better than sec? Nothing is better than sec when it comes to
monitoring Big Data applications. Try Boundary one-second
resolution app monitoring today. Free.
http://p.sf.net/sfu/Boundary-dev2dev
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
