Re: [tlug] But too much logs kills the logs: How to Grok Logs

[Raymond Wan <rwan.kyoto@example.com>]

Hi Bruno,


On Thu, Jun 7, 2012 at 1:36 AM, Braoult <braoult@example.com> wrote:
> If fact, I dont have log files, but emails (so I receive logs  even when not at home). And especially on my iPhone which is not really user friendly to read large files). In fact I recently just deleted these emails for this exact reason. I hope smaller mails will motivate me to read them :-)


The difference between e-mails and log files is just the e-mail header.  :-)

Seriously, about your iPhone problem, one thing you can do is to run
the e-mails through a filter like procmail and bounce off a filtered
version to an account where your iPhone reads e-mail from.  If
diskspace isn't an issue, keep the original, unfiltered log somewhere.
 You may need it again some day.


> After all this is just my home  dir backup. Nothing really vital. And I believe incremental backups would better give information on what is really changed (instead of everything, including what is not changed, which is the rsync works with my options). This is what my grep is supposed to do (if I did not make a mistake :-)


For your incremental backups, you're creating only one backup or
you're keeping several?  Sometimes, you don't know something went
wrong or a file is missing until after a few backups have taken place.
 So, it is good to have the old ones around, too.

And I think human error is more common than hardware failure (well,
depends on how sleepy you typically are and where you get your
hardware from :-) ).  I often have to recover a file I deleted by
accident...  :-D

Ray