Ubuntu Manpage: epylog - Syslog new log notifier and parser.

NAME

       epylog - Syslog new log notifier and parser.

SYNOPSIS

       epylog [-c epylog.conf] [-d LOGLEVEL] [--last PERIOD]
              [--store-offsets] [--quiet] [--cron]

DESCRIPTION

       Epylog  is  a  new  log  notifier  and  parser  which  runs periodically out of cron, looks at your logs,
       processes the entries in order to present them in a more comprehensive format, and then provides you with
       the  output.  It  is  written  specifically  with  large network clusters in mind where a lot of machines
       (around 50 and upwards) log to the same loghost using syslog or syslog-ng.

       Alternatively, Epylog can be invoked from the command line and provide a log report based  on  a  certain
       provided  time period. In this case it relies on syslog timestamps to find the offsets, as opposed to the
       end-of-log offsets stored during the last run, though this behavior is not  as  reliable  and  is  easily
       thwarted by skewed clocks.

OPTIONS

-c config.file
Provide an alternative config file to Epylog. By default, it will look in /etc/epylog/epylog.conf.

-d LOGLEVEL
Logging level. The default is 1. 0 will produce no output except for critical errors (useful for
cron runs). 2 and above are debugging levels. 5 is the most verbose.

--last PERIOD
Will make a report on events that occurred in the last PERIOD. PERIOD can be either "hour", "day",
"week", "month", or more granular: "1h", "2h", "3d", "2w", etc. When --last is specified, epylog
will ignore the saved offsets and locate the entries by timestamps. CAUTION: this process is not
to be trusted, since the timestamps are not checked for any validity when arriving to the loghost.
One reporting machine with a skewed clock may confuse Epylog enough to miss a lot of valid
entries.

--store-offsets
When specified, will store the offset of the last log entry processed in offsets.xml. During the
cron runs epylog relies on the offset information to find out what new entries to process. This is
more trustworthy than relying on timestamps. The default behavior is not to store the offsets, as
this allows to run epylog both from cron and manually without the two interfering with each-other.
The location of offset.xml is specified in epylog.conf. See epylog.conf(5) for more details.

--quiet
In every way identical to -d 0.

--cron This is essentially --quiet --store-offsets, plus a lockfile will be created and consulted,
preventing more than one instance of epylog from running. You can still run epylog manually -- the
lockfile is only checked when running in --cron mode.

FEATURES

              The  core  of epylog is written in python. It handles things like timestamp lookups, unwrapping of
              "last message repeated" lines, handling of rotated files, preparing and  publishing  the  reports,
              etc.

              The  modules  are pluggable and can be either "internal", written in python, or external. External
              modules can be written in any language, but at a price of some  convenience.  For  more  info  see
              epylog-modules(5).

INITIAL RUN

              Depending  on  the  size  of  your  logs, you might want to initialize your offsets before letting
              epylog run from cron. When the offsets.xml file is missing, epylog will  by  default  process  the
              entire  log, and depending on your configuration, that can be a lot of entries. A good way to init
              epylog is to run:

              epylog --last day --store-offsets

FILES

       /etc/epylog/epylog.conf
       /usr/sbin/epylog
       /etc/cron.daily/epylog.cron
       /etc/epylog/*
       /var/lib/epylog/*
       /usr/share/epylog/modules/*

EXAMPLES

       The useful way to run from a command line is with --last. E.g.:

       epylog --last day
       epylog --last 2w

       When running from cron, you want to store the offsets and not rely on timestamps. There is  a  mode  that
       allows you to do this:

       epylog --cron

AUTHORS

       Konstantin Ryabitsev <icon@linux.duke.edu>