On Tue, 2005-08-30 at 21:21 +0200, Peter Varlien wrote: > I have a couple of situations where the originating host from syslogd's > (and thus the syslog monitor's) point of view isn't the system I want to > report certain events on. I'm curious. Wouldn't in your case the node nameinsyslog=nameinbigsister syntax for telling Big Sister how it should translate single host names in the log be sufficient? > In Andrew's case, though, the correct solution is probably to configure > the base logfile monitor to understand which column in the webserver > logfile is the hostname. Probably this means creating a "weblog" subclass > to logfile, like the syslog and eventlog subclasses that already exist. > Assuming he can't persuade his webserver to write a logfile in syslog > format. Yes, you are right. I did not pay attention that he was not talking about syslog, but about the generic "logfile" monitor - which of course does not know which part of a log line corresponds with a host name. Best regards, Tom -- ---------------------------------------------------------------------------- Thomas Aeby, Kirchweg 52, 1735 Giffers, Switzerland, Tel: (+41)264180040 Internet: suppressed PGP public key available ---------------------------------------------------------------------------- ------------------------------------------------------- SF.Net email is Sponsored by the Better Software Conference & EXPO September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf _______________________________________________ Bigsister-general mailing list suppressed https://lists.sourceforge.net/lists/listinfo/bigsister-general
Mail converted by mhonarc 2.6.15
This archive provided courtesy of JSW4.NET, Internet Hosting Services for Small Business.