UNIX for Advanced & Expert Users

Hi Thinkers,

On AIX 5.3, we have a monitor program that reads the log file and searching for a certain string pattern that we define(say "transactionException"), if it sees it then it will raise an alert by sending an email.

Because the log file XXX.log is rolling into XXX.log.0, XXX.log.1, XXX.log.n...etc when a certain condition(size, time/date) meets, now my question is, is that possible that when the application generates the string "transactionException" and then it got rolled/renamed into XXX.log.0 before the monitor program sees it ? The monitor program is configured to monitor XXX.log file only ?

I am not sure how the monitor program is coded so I'd like to ask this way, if you are developing such monitor tooling, what you'd think to avoid the senario that I described above? I believe this may be to do with how Unix handle file deep down at the very low level ...


Your knowledge on this is much appreciated.

Thanks a ton.

Thegunman

If each log file entry has a date stamp alongside it then the monitoring process could keep track of the alerts it has already seen and then it could look at the tail end of XXX.log.0 as well as the contents of XXX.log?

The better solution would be for the monitoring software to roll the log files it is looking at so that it can do the log file rolling directly after checking the log file.

Another way round it is that the code rolling the log files does this:

Code:

mv XXX.log XXX.log.0
tail -3 XXX.log.0 >> XXX.log

So that the tail end of XXX.log.0 is retained in XXX.log, this would cause log file entries to be in more than one file. I suggested appending the tail end of XXX.log.0 onto XXX.log just in case some new entries have already been put into XXX.log.

thanks a lot for your reply !! TFM!

The monitoring process has to be transparent to the application so it can only do read to the file.