errpt to syslog help

[misn1day]

I am trying to set up errpt to log to syslog using the following:

errnotify:
en_pid = 0
en_name = "syslog"
en_persistenceflg = 1
en_label = ""
en_crcid = 0
en_class = ""
en_type = ""
en_alertflg = ""
en_resource = ""
en_rtype = ""
en_rclass = ""
en_method = "/usr/bin/errpt -l | /usr/bin/tail -1 | /usr/bin/logger -t
errpt -p daemon.notice"

It works great except for one thing, it logs several entries for every one entry it should log. Does anyone have any ideas on this or maybe a better way that they have set up errpt to syslog? Thanks

 

[bi]

If you are trying to be alerted when an errpt is made, take a look at FAQ faq52-2445. It contains a script that one of the tek-tips forum users wrote. I use it on my systems and it works great.

 

[misn1day]

I am more interested in getting errpt to work with syslog. I have a syslog server already set up to gather all my notifications and I just want one central location to monitor al the servers. But thanks!

 

[RPie]

You're missing a $1 on the following line:

en_method = "/usr/bin/errpt -l $1|/usr/bin/tail -1|/usr/bin/logger -terrpt -pdaemon.notice"

 

[misn1day]

I added the $1 but still get multiple alerts.

This is the line from syslog.conf that tells it where to log the file.
daemon.notice /var/adm/daemon

And here is a snip of what /var/adm/daemon looks like after I run the following test (I received about 12 of these line):
odmadd /home/personaldirectory/errlog
errlogger testing

Feb 10 08:20:30 corpserv1 errpt: IDENTIFIER TIMESTAMP T C RESOURCE_NAME DESCRIPTION
Feb 10 08:20:30 corpserv1 errpt: AA8AB241 0210082003 T O OPERATOR OPERATOR NOTIFICATION
Feb 10 08:20:30 corpserv1 errpt: IDENTIFIER TIMESTAMP T C RESOURCE_NAME DESCRIPTION
Feb 10 08:20:30 corpserv1 errpt: AA8AB241 0210082003 T O OPERATOR OPERATOR NOTIFICATION
Feb 10 08:20:30 corpserv1 errpt: IDENTIFIER TIMESTAMP T C RESOURCE_NAME DESCRIPTION


My output from errpt is as follows:
IDENTIFIER TIMESTAMP T C RESOURCE_NAME DESCRIPTION
AA8AB241 0210082003 T O OPERATOR OPERATOR
NOTIFICATION

Thanks for the help and if anyone has a better way of logging errpt messages through syslog, I would love to hear about it.

 

[Sudmill]

Did you ever get this to log correctly?

Cheers

John (Sudmill)

 

[misn1day]

Nope, I still get the multiple alerts. The only differenct now is that I log everything to an Access database and I have a macro that goes and deletes all duplicates.

 

[Robnhood]

I have seen the same thing accomplished a different way. I am going to need to look it up.



Craig

http://www.SecurelySpeaking.com

 

[Robnhood]

What I found is similar to what you are already using, and it worked perfetly for me.

Craig

http://www.SecurelySpeaking.com