Re: Logging question

[Howard Chu <hyc@symas.com>]

matthew sporleder wrote:
> On 6/13/06, Ski Kacoroski <ckacoroski@nsd.org> wrote:
> > Hi,
> >
> > How do folks handle logging and debugging on a busy ldap server without
> > being able to filter the logs into different files.  In particular, I
> > have a server that holds both machine and account data.  The machine
> > data is updated quite often via a cron job run on the machines
> > (cfengine) and swamps what is happening from the user side.  My first
> > approach was to separate out the machine logs into another file, but I
> > could find nothing to filter on.  My second attempt is to put the user
> > data and machine data into two different machines, but this is a waste
> > of resources as a single machine can easily handle the load.  As near as
> > I can tell, separate databases on the same machine will not help out
> > either.  So I am wondering what other folks do for debugging on busy
> > machines - e.g. how do you filter the logs so you can see the part you
> > are interested in).
>
> I parse the logs into a hash of hashes of arrays with perl and then
> get the info I need.  In your case, you would probably have to split
> that hash of hashes of arrays into an even more complex data
> structure.
>
> Or you could look into the access log overlay.  :)

That may be a good solution. Define two separate log databases, and 
separate the machine and user data into two databases, using 
subordinates to glue them together. Use an accesslog overlay on each 
main database, logging to separate log databases.

Of course, the info in the accesslog may not be detailed enough for 
debugging purposes. You'll have to review the log schema and decide for 
yourself if it's adequate for your needs.

--
 -- Howard Chu
 Chief Architect, Symas Corp.  http://www.symas.com
 Director, Highland Sun        http://highlandsun.com/hyc
 OpenLDAP Core Team            http://www.openldap.org/project/