SUMMARY: How to monitor console messages?

From: David Mostardi (david@slag.capmkt.com)
Date: Wed Oct 20 1993 - 05:45:23 CDT


QUESTION:
=========
I'm sitting here on my Sun (4.1.3), and every 20 minutes,
like clockwork, the console receives a message:

    Oct 18 15:47:38 slag -- MARK --

This is probably a harmless local mod by my predecessors,
but I have been unable to detect the sender of this message.
The generalized form of my question is:

    Is there a way to monitor the Console in order
    to ascertain which process is sending Message X there?

ANSWER:
=======

Yea verily, the Answers didst flood my mailbox.

1. Who makes the "MARK" message every 20 minutes? Syslogd.
   In my syslog.conf there is a configuration entry "mark.info"
   which sends the "MARK" message to the indicated file
   every 20 minutes. To cancel, I can edit out "mark.info"
   and send "kill -HUP" to syslogd.

2. How to generally monitor the Console? Suggestions,
   yet untried by myself, include:

   a. (Jim Redpath) Find the pid of the console from the ps command
      and do a "trace -p pid", i.e.:

      244 p6 IW 0:23 cmdtool -Wp 0 0 -Ws 590 77 -WP 3 833 ...
      245 p6 IW 0:00 -bin/csh (csh)
      249 p7 IW 6:28 cmdtool -Wp 26 23 -Ws 961 791 -WP 10 ...
      250 p7 IW 0:00 -bin/csh (csh)
      ags% trace -p 244

   b. (Brian Decker) For general system monitoring purposes,
      I recommend Swatch. Swatch is a set or Perl scripts that
      can be set up, via config files, to monitor files such as
      /var/adm/messages, /var/log/syslog, for "interesting"
      events, and then to take some action. The actions that can be taken
      are essentially at your discretion,since swatch will start any program
      or script that you have permission to execute. Swatch can found
      on sierra.stanford.edu in the /pub/sources directory.

   c. (Eric Burger) You might try lsof on the console when you expect
      to get the message, so you can see who's got the console device open.

Chalk up another one for the Sun Managers list.
Best email list I've ever belonged to!

Thanks to my respondents:
Pauline van Winsen - Uniq Professional Services <pauline@uniq.com.au>
tkevans@eplrx7.es.duPont.com (Tim Evans)
"Derrick J. Brashear" <db74+@andrew.cmu.edu>
einari@rhi.hi.is (Einar Indridason)
Jim Redpath SRI Ft Bragg <jredpath@ags.ga.erg.sri.com>
dbrillha@dave.mis.semi.harris.com (Dave Brillhart)
"Rick Weldon, Sys. Adm 55060" <rick+@badboy.hq.af.mil>
Timothy G. Smith - Special Projects <tgsmith@Sun.COM>
brian@arthur.melpar.esys.com (Brian Decker)
bboards@optical.bms.com (Jay Anderson)
ems@ccrl.nj.nec.com (Ed Strong)
townsley@rocky.er.usgs.gov (Bill Townsley)
pete@physical-chemistry.oxford.ac.uk (Pete Biggs)
Andrew Benson <drew@mtu.edu>
shuque@spectre.sas.upenn.edu (Shumon Huque)
Steinar Haug <Steinar.Haug@runit.sintef.no>
farrell@mr.med.ge.com (Brian Farrell 4-6531)
dotty@elvis.tgivan.wimsey.bc.ca (Dotty Pon)
kbs@huey.mis.semi.harris.com (Ken Stoddart)
nick@dsd.es.com (Nick Nickerson)
"Fuat C. Baran" <fuat@watsun.cc.columbia.edu>
birger@vest.sdata.no (Birger A. Wathne)
kmah@DCS-Systems.COM (Kevin Mah)
ericb@telecnnct.com (Eric Burger)
tank@amoco.com (Jon A. Tankersley)
david@srv.PacBell.COM (David St. Pierre)
hsafai@esri.com (Houman Safai )
Ray Schnitzler <ras@unipress.com>
-------------------------------------------------------------------
David Mostardi Email: david@capmkt.com
Network & Systems Manager Phone: (510) 540-6400
Capital Market Technology, Inc. FAX: (510) 540-5505
1995 University Ave. #390, Berkeley CA 94704



This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:08:25 CDT