my 2 cents:

• for OS, i'd say %warn|err|panic|critical|exception
• for application, it really depends what kind of output your applications spew out using syslog.
• check syslog.conf to make sure you have all the important events logged to /var/log/messages or whichever log u r monitoring

On 1/17/07, Michael A. Price <mprice at hst.nasa.gov> wrote:

Hello,

I figured out my LOG monitoring configuration issues and I have it working!!!!

Now,

What patterns are a good start for matching in /var/log/messages ???

CRITICAL ??

WARNING ?? NOTICE ??

thanks, michael

--

Michael A. Price Performance Network Engineering NASA/GSFC Code 440.8/LMB Greenbelt, Maryland 20770 Phone: 240-684-1356 Cell: 410-507-7476 e-mail: mprice at hst.nasa.gov

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk