Idea Details

Too many error messages on Syslog

Last activity 12-17-2016 11:07 AM
kansi02's profile image
03-17-2015 02:32 AM

 

Issue #: 00039421: SELOGRD OFFSET ERROR IN SYSLOG

 

 

 

Requirement :

 

If there is some error on selogrd, mountain of error messages will be written on syslog with the same pattern.

 

For instance,

 

Mar  3 00:36:05 hostname selogrd[23186]: ERROR: skipping invalid data in audit file at offset 2576815

 

Mar  3 00:36:05 hostname selogrd[23186]: ERROR: skipping invalid data in audit file at offset 2576815

 

 

Mar  3 00:36:05 hostname selogrd[23186]: WARNING : Repeat read audit log at offset 2576795 in 25 sec

 

Mar  3 00:36:05 hostname selogrd[23186]: WARNING : Repeat read audit log at offset 2576795 in 25 sec

 

 

Apr 28 17:29:47 swmeqa04 selogrd[5117]: Unable to communicate with [168.219.173.66: RPC: Success]

 

Apr 28 17:33:47 swmeqa04 selogrd[5117]: Unable to communicate with [168.219.173.66: RPC: Success]

 

 

 

 

But syslog is very important file to be always monitored by system administrator group, not just for PIM administrator.

 

The problem is that this is not important message to system administrator group. It is just important to PIM administrator.

 

If there is some error message like above, all system administrator group will be receive the critical alert like short message, email, broadcasting.

 

So Samsung wants to build the option that can separate this message from syslog, and write to a different file.

 

For instance, [selogrd] block in seos.ini will have a new token “error_file”. That token will have “syslog”, “selogrd.err”, “both” etc.

 

Depending on the option, the error message will be written to syslog or selogrd.err or both.

 

 

 

Biz Impact :

 

Due to too many alerts, all the system administrators should repeatedly  categorize the issue and analyze the root cause and report the result to high-up manager.

 

Even though very long analyzing is conducted, some causes are still in the fog and some causes are in the network problem (physically it is not easy to fix the network problem at customer environment).

 

So as the alternative Samsung wants to build an option that choose which file could be used.

 


Comments

09-18-2015 11:08 AM

Hi @kansi02 - Thanks for the submission.  This item is currently under review.