Too many error messages on Syslog

Idea created by kansi02 Employee on Mar 17, 2015
    Under review
    Score13

     

    Issue #: 00039421: SELOGRD OFFSET ERROR IN SYSLOG

     

     

     

    Requirement :

     

    If there is some error on selogrd, mountain of error messages will be written on syslog with the same pattern.

     

    For instance,

     

    Mar  3 00:36:05 hostname selogrd[23186]: ERROR: skipping invalid data in audit file at offset 2576815

     

    Mar  3 00:36:05 hostname selogrd[23186]: ERROR: skipping invalid data in audit file at offset 2576815

     

     

    Mar  3 00:36:05 hostname selogrd[23186]: WARNING : Repeat read audit log at offset 2576795 in 25 sec

     

    Mar  3 00:36:05 hostname selogrd[23186]: WARNING : Repeat read audit log at offset 2576795 in 25 sec

     

     

    Apr 28 17:29:47 swmeqa04 selogrd[5117]: Unable to communicate with [168.219.173.66: RPC: Success]

     

    Apr 28 17:33:47 swmeqa04 selogrd[5117]: Unable to communicate with [168.219.173.66: RPC: Success]

     

     

     

     

    But syslog is very important file to be always monitored by system administrator group, not just for PIM administrator.

     

    The problem is that this is not important message to system administrator group. It is just important to PIM administrator.

     

    If there is some error message like above, all system administrator group will be receive the critical alert like short message, email, broadcasting.

     

    So Samsung wants to build the option that can separate this message from syslog, and write to a different file.

     

    For instance, [selogrd] block in seos.ini will have a new token “error_file”. That token will have “syslog”, “selogrd.err”, “both” etc.

     

    Depending on the option, the error message will be written to syslog or selogrd.err or both.

     

     

     

    Biz Impact :

     

    Due to too many alerts, all the system administrators should repeatedly  categorize the issue and analyze the root cause and report the result to high-up manager.

     

    Even though very long analyzing is conducted, some causes are still in the fog and some causes are in the network problem (physically it is not easy to fix the network problem at customer environment).

     

    So as the alternative Samsung wants to build an option that choose which file could be used.