The ESMSysLog Daemon Monitor

Introduction

One of the most usefull things to monitor with ESM is the syslog. ESMSyslog can do that with a few simple changes to your syslog configuration.

Configuring syslogd

ESMSysLog communicates with syslogd with FIFOs. First you have to create the FIFOs. To do this run: (as root)


mkdir /var/esmsyslog
cd /var/esmsyslog
mkfifo emerg
mkfifo alert
mkfifo crit
mkfifo err
mkfifo warning
mkfifo notice
mkfifo info
mkfifo debug
chmod 600 *

Now you will have a nice set of FIFOs that are only readable by root. Next you have to tell syslogd to use those FIFOs. In my case I use:


*.emerg                         |/var/esmsyslog/emerg
*.alert                         |/var/esmsyslog/alert
#*.crit                          |/var/esmsyslog/crit
#*.err                           |/var/esmsyslog/err
#*.warning                       |/var/esmsyslog/warning
#*.notice                        |/var/esmsyslog/notice
#*.info                          |/var/esmsyslog/info
#*.debug                         |/var/esmsyslog/debug

Just put that in your /etc/syslog.conf file and your done. If you don't want to log a error message level just put a # in front of the line. Notice how it's setup to only log emerg and alert messages right now.

Also please remember that there are security implecations. If authpriv.* messages are sent via email anyone who intercepts the email may be able to get passwords. If possible use encryption in your senders.

Running ESMSysLog

To run ESMSysLog just add it to the /etc/esm directory. It's a daemon monitor so the type will be dmonitor.

Command line options


-n, --notifylevel x

The notify level. If ESMSysLog recives a messge with a priority
greater then x it will send a SIGUSR1 to esmd to make it check the
status of all of the dmonitors. Defaults to 8 (ESM_LOG_EMERG)

Note that ESMSysLog waits 1 minutes before actually notifying esmd so
multiple messages won't trigger multiple system reports. Also it won't
notify esmd more then 1 time per half-hour. (This can be changed with
the --fcint option) Often emergency messages come in big batches. We
don't want to get a huge number of system reports. And what would
happen if the act of sending the system report generated a emergency
message? This way we won't get thousands of messages.

-m, --maxmsgs x

Don't record more then x messages. ESMSysLog saves all of the messages
it recives untill esmd tells it to make a report.  However if it keeps
too many it may run out of memory. Defaults to 2048 

Note that the more msgs there are the slower it is to make a
report. On slow machines you may want to set maxmsgs to about 500 to
avoid timeouts and excessive cpu usage.

If new messages come in while the buffer is full old messages at the
end of the buffer will be deleted.

-s, --savepri x

If messages have to be deleted try to avoid deleteing messages with a
priority greater then x. Instead messages with lower priorities will
be deleted first. Defaults to 5 (ESM_LOG_ERR) If you set this too low
ESMSysLog will search the whole buffer for low priority messages many
times. Each time savepri will be set a little higher. If you set this
too high you may lose important messages.

--fcint x

esmd won't be forced to check the dmonitors more then 1 time per x
seconds. Defaults to 1800, 30 minutes.

-h, --help

Help of course.

-v, --version

Prints some version information.
Index
© 1999 Peter Todd
Created on 09/21/1999 Last update - $Id: esmsyslog.html,v 4.0 1999/10/07 22:57:35 pete Exp $