Re^2: adaptive syslog message parsing

It seems to me the cumulative frequencies of message types(for each server, daemon name combination), would be less useful then the sequence of events.

hash{servers}
   hash{daemon names}
      array[$time, message]

or

$struct->{$server}->{$daemon}->[$message_id] = [$time,$message];
[download]

Though for either method it would be nice to send a GD generated graph for each set server/daemon, which can give quick access to needed information.

Comment on Re^2: adaptive syslog message parsing Download Code

Replies are listed 'Best First'.
Re^3: adaptive syslog message parsing by thezip (Vicar) on Jun 07, 2007 at 07:12 UTC
Yes, these are a nice enhancements, but they are not to the OP's specification which detailed that the statistical frequencies (ie. counts) be stored in the lowest hashes. I cannot comment as to which is better since I don't have the bigger picture of the problem. Where do you want them* to go today?*	[reply]