evmlogger.conf.4 (2010 09)

evmlogger.conf(4) evmlogger.conf(4)

filter "[prio >= 200]"

# Suppress logging of duplicate events:

suppress

{ filter "[name *]"

period 30 # minutes

threshold 3 # No. of instances before suppression

}

# Log high-priority events to the system console:

eventlog {

name console_log

logfile /dev/console

filter "[prio >= 600]"

type formatted

show_template "@timestamp [@priority] @@"

}

# Forward details of high-priority events to root:

forward {

name priority_alert

# Don’t forward mail events through mail (see note above):

filter "[prio >= 600] & ![name @SYS_VP@.syslog.mail]"

suppress

{ filter "[name *]"

period 120 # minutes

threshold 1 # No. of duplicates before suppression

}

# This evmshow command writes a subject line as the first line of

# output, followed by a detailed display of the contents of the

# event. The resulting message is distributed by mail(1).

command "evmshow -d -t ’Subject: EVM ALERT [@priority]: @@’ \

| mail root"

}

FILES

/etc/evmlogger.conf

Location of the EVM logger conﬁguration ﬁle.

/var/evm/adm/config/logger Default location of the secondary EVM logger conﬁguration

ﬁles.