Re: [gentoo-user] problem filtering portage messages...

[Jarry]

Albert Hopkins wrote:
> On Sat, 2009-08-22 at 10:39 +0200, Jarry wrote:
>> The problem is with portage logs: I can not find any pattern
>> I could use to filter them out.

> I'm not sure what you are trying to "filter out".  Portage logs are
> relatively machine-readable (e.g. qlop).

syslog-ng in client mode does not open new connection for every
source (be it /dev/log, /proc/kmsg/, /var/log/messages, etc.).
Instead of that, it opens only one connection and "pumps" logs
to server in one stream. It is a log-server's job to split it out.

The first quite natural filter-rule is to split logs according
to client-IP (or hostname). The second level is to split logs
according to application. I do not want to have logs from kernel,
sshd, apache, ntp, portage, ftp, dns, mixed together in one file.

And that is a problem. I can easily identify logs from i.e. sshd:
 > 2009-08-22T10:54:30+00:00 obelix sshd[6984]: Accepted...
Simply I use filter "sshd*" for the 3rd field (application name).

Or in case of ntpd-logs I put filter for "ntpd*":
 > 2009-08-22T10:54:48+00:00 nitino ntpd[4421]: synchronized...

But what do I have to do with this:
 > 1250867551:  *** Finished. Cleaning up...
or:
 > 1250867528: === Sync completed
How can a log-server indentify it as portage-log so that it could
save it into /var/log/$HOST/emerge.log?

> If you don't mind getting your hands dirty, portage is written mostly in
> python and bash so it shouldn't be that difficult to dig into the parts
> that handle emerge.log and emerge-fetch.log and convert them to syslog.

Well, I'm affraid this is beyond my skill. I've looked at those
scripts, but they seem to me to be really complicated...

Jarry

-- 
_______________________________________________________________
This mailbox accepts e-mails only from selected mailing-lists!
Everything else is considered to be spam and therefore deleted.