Re: [tlug] But too much logs kills the logs: How to Grok Logs

[Braoult <braoult@example.com>]

Hi Attila,

--
Sent from my iPhone. 

On 2012/06/06, at 14:55, Attila Kinali <attila@example.com> wrote:

>>> I meant: You want the logs to be useful. For instance, I may have 10-20
>>> file changes every day.
>>> If the log shows 1,000 lines, I will never know about these 10 lines...
>> 
>> That's probably not a good use of your log files. 
>> When things go bad, you should have enough data in your log 
>> files to figure out what/how things went bad and to fix it. 
>> So let your log files be big.

If fact, I dont have log files, but emails (so I receive logs  even when not at home). And especially on my iPhone which is not really user friendly to read large files). In fact I recently just deleted these emails for this exact reason. I hope smaller mails will motivate me to read them :-)

> Juup, that's why any sysadmin worth his money does use logcheck (or
> any other similar system) that filters his logs and notifies him
> if something unusual happens.. But when it happens, you want to have
> each and every line there can be.

Agreed on principle, but not for this script in particular. It is verbose enough to catch errors (normally :-). And I can relaunch it at anytime without the new grep, if I need more logs.
After all this is just my home  dir backup. Nothing really vital. And I believe incremental backups would better give information on what is really changed (instead of everything, including what is not changed, which is the rsync works with my options). This is what my grep is supposed to do (if I did not make a mistake :-)

Thanks again,

Regards,

Bruno.