Chapter 4. Automating Lire

Table of Contents

Automatically Processing Log Files Using Cron
Configuring lr_cron
Installing the Cron Job
Automatically Processing Log Files Through A Responder
Automatically Processing Log Files In A Server Farm

This chapter discusses various ways to configure Lire™ for generating periodical reports from your system logs.

Automatically Processing Log Files Using Cron

The easiest way to have Lire™ generate reports from the various log files available on your system is through a cron job. Lire™ includes a script called lr_cron which takes care of calling the appropriate batch of commands on the appropriate log files. The reports are generated in the ASCII format and are sent to an email address of your choice. To use lr_cron, you are advised to configure Lire™ using lr_config.

Configuring lr_cron

When running lr_config, it will allow you to set values for the global configuration of Lire™ and specific question for when you run a responder. It also allows you to create and configure one or more cron jobs.

First, you will have the possibility to set default values that will be used for each service. You will also get the chance to override those defaults on a per-service case. Those parameters are: the email address that will receive the report, the string that will appear in the subject of the email and the periodicity of the job.

Then you can create new jobs. For each job you should specify at least the type of the log file, the path to the log file, the periodicity and an email address to send the report to.

There's also a possibility to specify a filter which will be used to process the log file before creating a report from it. Using this feature you can process compressed log files or discard irrelevant lines for a particular service. For these cases, you would use zcat or grep as filters.

Installing the Cron Job

Installing the cron job is really easy: lr_config will give you the appropriate lines to add to your cron job. The lines to add to your crontab should look similar to:

0 0 * * * /usr/bin/lr_cron daily
0 0 * * 0 /usr/bin/lr_cron weekly
	    

Once activated like this, report(s) will be sent on a weekly and/or daily basis.