4

I have a remote server which has some issues (Seem hardware related) which means that it logs KVM errors and then sometime later it becomes unresponsive and locked up. There is an often an early indication of it failing, in the dmesg log output, so I would like to know, is there a Debian utility which can send me (daily?) digests of the dmesg (/var/log/kern.log) output?

  • 1
    You might consider a cron job to mail you the logs (or portions of the logs using tail/etc) that you want. – tamarintech Oct 17 '13 at 14:02
  • logcheck will do all logs, not just dmesg. You may also want to check if your hardware features a watchdog (or try softdog), to at least recover the remote system after it hangs. – derobert Oct 17 '13 at 14:23
  • 1
    may be it's better to use syslogto send kern.info or kern.notice messages to other host? – dchirikov Oct 17 '13 at 17:55
2

In the past I've used logwatch to do exactly this. Directions on customizing it are here, titled: HOWTO-Customize-LogWatch.

Installation

$ sudo apt-get install logwatch

Setup

Logwatch runs daily but can be configured to run more frequently It's typically kicked off from a crontab entry.

$ ls -l /etc/cron.daily/0logwatch
-rwxr-xr-x 1 root root 265 Feb 28  2011 /etc/cron.daily/0logwatch

Customizations can go here:

/etc/logwatch/conf/logwatch.conf

To email yourself the daily summary:

MailTo = me@example.com

If you want to add additional rules around a particular log file you can copy the existing rule file and modify as needed:

$ cp /usr/share/logwatch/default.conf/logfiles/syslog.conf \
      /etc/logwatch/conf/logfiles/

Take a look at this section of the conf file, you can add additional rules here:

*ExpandRepeats
*RemoveService = talkd,telnetd,inetd,nfsd,/sbin/mingetty
*OnlyHost
*ApplyStdDate

Going further

I'd consult this tutorial titled: Monitor System Logs with Logwatch on Debian 5 (Lenny) for more details if you'd like to expand the monitoring beyond just he stock things that logwatch does out of the box.

| improve this answer | |
  • Excellent, I used logwatch, setup was a bit different (I guess squeeze has the config packed different, had to copy from /etc/default and stuff) – user49411 Oct 21 '13 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.