[wellylug] hating on the Logwatch

[Daniel Pittman]

Spiro Harvey <spiro at starforge.net.nz> writes:
>> Oh, and I think I had the "ah-ha!" moment about the other model of
>> monitoring.  When I say that, do you think "watching for specific
>> events and reacting to them?"
>
> That's what I perceive a monitor to do. To me, Logwatch makes me think
> "a record of stuff that's been happening lately."

OK.  That makes your objections, and views on logwatch, make a lot more
sense to me.  Thank you for taking the time to explain that.

>> *nod*  That parenthetical comment is the bit that really gets me: you
>> can only tell that something interesting happened because the routine
>> noise[2] has changed or something has been omitted?
>
> Basically, but it also acts as a historical record that I can go back
> to.. For example, I can get answers to trivial stuff like "what was the
> disk usage on Friday the 10th of Foovember?"

That is a useful feature; while I think logwatch isn't a great tool for
that sort of historic information, I don't think it is bad, either.

>> That isn't an effective mechanism for alerting you to anything, even
>> if it sometimes works.
>
> And certainly not if you want those alerts in real-time.. That's what
> NAGIOS is for.

*nod*

>> I don't believe this is a good model to use, because those problems
>> will result in real issues being missed, where an "exceptions only"
>> model will highlight them.[3]
>
> You're right, and I certainly would never advocate Logwatch as the
> sole "monitoring" tool. It's just another screwdriver in my
> toolkit. It has its uses and it has its limitations.
>
> One of these days I'll write something that will throw up in some
> graphing software's lap and spit out pretty pictures of the historical
> minutiae I get from Logwatch. But not this week.

Well, it seems we generally agree, and I will keep your comments in mind
in future when it comes to my hatred of logwatch. :)

Regards,
        Daniel