Michael Monnerie wrote: > On Mittwoch, 12. September 2007 15:24 Anne wrote: >> I get your point but it is against good design principles. >> Optimization of logfiles and usage of external tools is the way to >> go, which has already been said by Paul. > > I've already given one example where it has advantages: > 1) Our customers should be able to check logs themselves. Via DB, it's > easy to SELECT .. where customer='xxx' and date=yesterday; that would > be horribly slow when parsing the normal text syslog.
I wrote this little diddy a couple of months ago to get real-time apache statistics. And no: it doesn't parse the logfiles for each query, and no I didn't hack up an apache module. The basic idea: tail -f /var/log/apache/access.log | myanalyzer myanalyzer analyzes the loglines it reads on stdin and generates both rrd databases (every 5 minutes) and rows in a sqlite or mysql database. Of course the same could easily be done for dbmail lines in syslog. In apache we use netcat to pipe the apache logs over UDP to a special server which aggregates logs for all apache front-end servers. On that server the logs are read on a UDP socket and fed to the post-processing pipeline. No more mergelog. -- ________________________________________________________________ Paul Stevens paul at nfg.nl NET FACILITIES GROUP GPG/PGP: 1024D/11F8CD31 The Netherlands________________________________http://www.nfg.nl _______________________________________________ DBmail mailing list [email protected] https://mailman.fastxs.nl/mailman/listinfo/dbmail
