Re: important errors to control with swatch

I'm also extremely interested in expanding my log watching to include a massive amount of comprehensive pattern matching alerting.

I currently have some but need to expand it. The problem is that this is really a difficult thing to approach because it can only catch known patterns in this fashion. And whitelisting is really not practical in this context as the logs generated are practically infinite and not really able to whitelist them.

I think that there should really be a well maintained project of regexs for this purpose, one official champion for us to build our baselines on... with frequent updates...

Anyone got any ideas or regexs they want to share?

Isaac, you would do well to have things like "I/O Error" for disk problems... "hardware hung"... etc etc, but this list is practically endless, you should look at your logs and decide which ones you'd like to be alerted on.


Hari Sekhon

Isaac Perez Moncho wrote:
I just installed swatch, and used this configuration file for the

Anyone knows any other common phrase or word that I should find the logs
for hardware and system errors?
Or what you consider important to monitor in the logs?