improving signal to noise ratio from centralized network syslogs
Scott Weeks
surfer at mauigateway.com
Mon Feb 5 18:55:27 UTC 2018
--- shane at short.id.au wrote:
In addition to that, you can use some fancy awk colour
coding, so you can make it highlight certain lines based
on content.. I use this for my e-mail logs, but I’m sure
it could be adapted:
tail -n 1000 -f /var/log/mail-submission.log | grep smtp.*relay | awk '
/sent/ {print "\033[32m" $0 "\033[39m"}
/bounced/ {print "\033[31m" $0 "\033[39m"}
/deferred/ {print "\033[33m" $0 "\033[39m"}
----------------------------------------------------
The main thing for me is to find things that
your network is doing that you weren't aware
of. Not normal things you want to see that
a monitoring system will alert you about.
scott
More information about the NANOG
mailing list