Chapter 4 - DSpace at Waseda University

Chapter 3
shows how useful the logged event logs are for a system developer.
3.1.2 Event Log Monitoring
Figure 3.1: flow chart of the event log
Because of the importance of event logs as the source of system health information, many
tools have been developed over the past 15-20 years for monitoring event logs in real-time.
Swatch [Hansen and Atkins, 1993] was the first such tool and is still used by many sites.
Swatch [47] monitors log files by reading every event message line that is appended to the
log file, and compares it with rules where the conditional part of each rule is a regular
expression (rules are stored in a textual configuration file). If the regular expression of a
certain rule matches the event message line, Swatch executes the action part of the rule.
Actions include sending a mail, executing an external program, writing a notification to the
system console, etc. Swatch has also an option for ignoring repeated event messages for a
given time interval.
Another popular tool for event log monitoring is Logsurfer [Ley and Ellerman, 1996]. Like
24