UNIX for Dummies Questions & Answers

Hi all. I have a couple of scripts looking at my syslog.log, mail.log, and messages logs.

My scripts work well with syslog.log and messages logs. I use grep function and then make exceptions to things that I know happen often and that way can investigate better without being buried with useless info from the logs.

I use following:

Code:

egrep -iv 'checkpoint|homepage|added|quorum|updated|successful|etc|etc|etc|etc' /var/adm/syslog/syslog.log

The mail.log is the one thats quirky. Instead of using exceptions i.e. -v function in egrep, I would have to look for specifics. Like "error" or those type of things because there are so many lines...and then might miss things that are important.

I don't know a lot about what kind of problems may arise and how they are reported to mail.log. I would like to anticipate things better so that I can get more in tune with these logs and get potential problems better, faster and more intuitively.

Thanks,
Any info would be appreciated.

Why not use the simple way:

Code:

fgrep 'error' mail.log

If you already know there is no regular expression in your search pattern, it is best to use 'fgrep' - the internal algorithm is faster as it does not allow for RE.

Thanks,

I got a suggestion when I did that with syslog.log, and someone told me that if I do that I may miss important things because it would display lines containing "error" only.

Using -iv option I can ignore things which happen normally and catch all other things which may potentially be a problem.

However this is hard with mail.log. I don't really know what to not include in my search for problems with the mail.log.