[wellylug] hating on the Logwatch

[Spiro Harvey]

> Oh, and I think I had the "ah-ha!" moment about the other model of
> monitoring.  When I say that, do you think "watching for specific
> events and reacting to them?"

That's what I perceive a monitor to do. To me, Logwatch makes me think
"a record of stuff that's been happening lately." 

> *nod*  That parenthetical comment is the bit that really gets me: you
> can only tell that something interesting happened because the routine
> noise[2] has changed or something has been omitted?

Basically, but it also acts as a historical record that I can go back
to.. For example, I can get answers to trivial stuff like "what was the
disk usage on Friday the 10th of Foovember?"

> That isn't an effective mechanism for alerting you to anything, even
> if it sometimes works.

And certainly not if you want those alerts in real-time.. That's what
NAGIOS is for.

> I don't believe this is a good model to use, because those problems
> will result in real issues being missed, where an "exceptions only"
> model will highlight them.[3]

You're right, and I certainly would never advocate Logwatch as the sole
"monitoring" tool. It's just another screwdriver in my toolkit. It has
its uses and it has its limitations.

One of these days I'll write something that will throw up in some
graphing software's lap and spit out pretty pictures of the historical
minutiae I get from Logwatch. But not this week.


-- 
Spiro Harvey
UNIX Specialist, Writer, Editor

http://twiddle.starforge.net.nz
	
Give us this day our garlic bread and lead us not into vegetarianism
but deliver us some pizza.

+++
ATH0
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://lists.wellylug.org.nz/pipermail/wellylug/attachments/20090304/f6954d20/attachment.pgp