Re: [tlug] But too much logs kills the logs: How to Grok Logs

[Attila Kinali <attila@example.com>]

On Tue, 5 Jun 2012 15:47:38 -0400
jep200404@example.com wrote:

> > I meant: You want the logs to be useful. For instance, I may have 10-20
> > file changes every day.
> > If the log shows 1,000 lines, I will never know about these 10 lines...
> 
> That's probably not a good use of your log files. 
> When things go bad, you should have enough data in your log 
> files to figure out what/how things went bad and to fix it. 
> So let your log files be big. 

Juup, that's why any sysadmin worth his money does use logcheck (or
any other similar system) that filters his logs and notifies him
if something unusual happens.. But when it happens, you want to have
each and every line there can be. Nothing is more troublesome than
having the whole company colapsing due to a computer error and you have
to guess what has happend because one or two lines of logs are missing.

		Attila "been there, done that, got grey hair" Kinali

-- 
It is upon moral qualities that a society is ultimately founded. All 
the prosperity and technological sophistication in the world is of no 
use without that foundation.
                 -- Miss Matheson, The Diamond Age, Neil Stephenson