wiki:sysadminImportantLogs

The main gathering point for the logs is starburst. There is a problem with wildcard expansion for sudo commands so you need to use the format shown if you want wildcards:

  sudo ls -l /var/log/remote/prod/2009/08/27
  sudo sh -c "grep 27T17 /var/log/remote/prod/2009/08/27/*" | more

So in the example above, we are looking for error messages associated with 5 PM (T17) on Aug. 27, 2009

This is the error you never want to find:

  sudo sh -c "grep 'NOT CONNECTED' /var/log/remote/prod/2009/10/02/osrferror.log" | more

Sometimes, the trick seems to be to narrow things down:

  sudo sh -c "grep '2009-10-02 13:' /var/log/remote/prod/2009/10/02/*.log" > ~/stuff/work/oct.txt

And then working with a smaller set that eliminates the most obvious errors:

  grep '[Ee]rror' oct.txt | grep -v 'error.js' | grep -v 'does not exist' | grep -v 'unblessed reference' | more

There seems to sometimes be issues with phrase searching, this kind of convoluted grep is needed to find this:

  sudo sh -c "grep 'keyword:\\\\\"' /var/log/remote/prod/2009/10/02/*.log" | more

Sometimes, the response time is worth looking at:

  /var/log/remote/prod/2009/10/02/ap_access.log:2009-10-02 13:00:40 protostar logger: 216.254.218.64 - 
  - [02/Oct/2009:12:55:40 - 0400] "POST /osrf-gateway-v1 HTTP/1.1" 404 352 
  "http://windsor.concat.ca/opac/en-CA/skin/uwin/xml/rresult.xml?rt=keyword&tp=keyword&
  t=warfare%20in%20renaissance%20europe%3A%20gunpowder%2C%20technology%2C%20and%20tactics&l=106&d=1&f=&av=" 
  "Mozilla/4.0   (compatible; MSIE 8.0; Windows NT 6.0;

The time of the log entry is 5 minutes after the posting (recorded at 13:00:40 but sent at 12:55:40)

Last modified 11 years ago Last modified on Oct 3, 2009, 12:25:35 AM