On 02/01/2012 11:22 PM, ashok.vaira...@emc.com wrote: > Hello Team, > > We are planning to use this tool to triage and debug in our product. But > we do have few queries. Can you please clarify it? > > 1. Is it possible to use SEC to scan for specific pattern from a group > of log files? I do noticed that is used as an pre-emptive tool, I just > want to know whether it can be used as after-the-fact tool?
If you mean finding patterns from log files that have already been created, the answer is yes -- you have to use --notail option for this. Note, however, that a number of SEC's advanced event correlation features would not make sense in this particular context, since they work for real-time events only. > > 2. Does it listens to only one file or group of files? Can it monitor > bunch of files? yes, you can monitor arbitrary number of files. > > 3. If there are umpteen number of logfiles? What would be the > performance bootleneck? If you would be processing already created log files with --notail option, then there wouldn't be much CPU time spent for needless overhead. However, if you are monitoring a very large number of files in real time, file status polling can consume quite some resources. Fortunately, if many of the files do not change frequently (e.g., new data are added once a minute or even less frequently), you can employ the --check-timeout option for reducing resource consumption. For example, using --check-timeout=10 will skip a status poll for a file for 10 seconds, if it has not been modified. kind regards, risto > > Thanks, > > Ashok > > > > ------------------------------------------------------------------------------ > Keep Your Developer Skills Current with LearnDevNow! > The most comprehensive online learning library for Microsoft developers > is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3, > Metro Style Apps, more. Free future releases when you subscribe now! > http://p.sf.net/sfu/learndevnow-d2d > > > > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users ------------------------------------------------------------------------------ Keep Your Developer Skills Current with LearnDevNow! The most comprehensive online learning library for Microsoft developers is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3, Metro Style Apps, more. Free future releases when you subscribe now! http://p.sf.net/sfu/learndevnow-d2d _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
