Learning from Linux log files

Question

Hello,

I was wondering about the utility of storing metadata (Abbreviation Expansion, Brief Message, links to online resources) associated with messages, in /var/log/syslog, /var/log/kern.log etc.

For instance, for a message like ACPI: Processor [CPU1] (supports 8 throttling states) I would search online about CPU throttling, and store a brief information of what I understood, links that I visited, and throttling on Centrino (my processor) - I wouldn't have done that if I didn't search online for that message.

The objective is purely to improve my learning process and potentially read up on diverse aspects of systems. Additionally, I would also store the context in which I read something. I wrote a simple script in Perl to do this along with more elaboration on my blog.

Is there a better way to go about this? Or do, you think that the effort is not worth it? I look forward to suggestions!

Thanks! :-)

Answer 1

Your approach sounds like a good one. Ideally, people should be able to understand every line of their logs.

One resource that might come in handy is logcheck. It helps zero in both on what is most important as well as anomalies in your logs.