Log module retrieves log entries from system-wide log facilities, or specified log files.

Module name: “log”

Module version: 1.0

See Modules - Common API for general module description.

Module parses log files based on following criteria:
- what log files (defaults to /var/log/messages and /var/log/syslog)
- age of log entries (so one can retrieve logs from previous 4 days, or a month)
- tags (similar to keywords) none, one or multiple. If none, everything matches; if one, matching match; if more than one, either their union or intersection match (see next bullet)
- union or intersection, union being the default. Even if union is selected, returned log entries have matching tags attached; UI can group or intersect them in the cache, reducing number of round trips.

As module processes log files, each entry is assigned multiple tags. First tag will be a process name that logged entry. Second is a PID (if supplied). Simple algorithm tries to extract as much of tags as possible. Those tags are matched against named groups of keywords, and if found, group name is attached to log entry as yet another tag. Purpose of tags is to group log entries.
Search is performed on these tags.
For example, ccsd log entry will get assigned “ccsd” and “cluster” tags; GFS entries will get “gfs”, “storage” and “cluster” tags; dlm entries will get “dlm”, “cluster” and “kernel” tags, ...

Defined tag groups:
- “cluster” - matches all log entries from Cluster Suite (includes “cluster service manager”, cman, gulm, ccsd, GFS and LVS, among others)
- “cluster service manager” - matches all log entries from Cluster Service Manager (clurgmgr for now)
- “lvs” - matches all log entries from Linux Virtual Server: ipvs, ipvsadm, piranha, ...
- “storage” - matches all log entries about storage
- “selinux” - matches selinux log entries (audit, pam_*, selinux)

Log entry format:

<logentry domain="what it is about" pid=”process ID” age="age in seconds" msg="log message">
<match tag=”matching tag1”/>
<match tag=”matching tag2”/>
</logentry>

- “age” - age of entry in seconds (relative time was chosen, so that UI can display logs using user's time settings, and to remedy differences in clock settings)
- “pid” - PID that generated this log entry. Not every process logs its PID, so “pid” attribute might end up empty
- <match> - a tag this entry was successfully matched against (there could be multiple, eg. if search was performed on “kernel” and “cluster”, dlm log will be matched against both – could be used by UI to group or to find intersections within result – eg. “cluster” and “kernel”).



Functions: