pmg-log-tracker how does it do it's magic?

[Teucrus]

Hello,

Does anyone know how pmg-log-tracker and by extension tracking center knows which log entries to group?
I am trying to export the logs to an external log manager to increase to log retention and have it show larger date ranges thatn availble with tracking center.
I was able to export the logs, but I do not understand how the tracking center groups the entries for specific emails.
Can someone please let me know? Or if there is a log analyser that can do the same thing?
I am currently testing with nagios log server.

Thank you.

 

[dcsapak]

it's a combination of pid/port/time/id matching
there is a overview at https://git.proxmox.com/?p=pmg-log-...5e1eeaedaeeec694a6594099;hb=refs/heads/master
and for more details the source is available at
https://git.proxmox.com/?p=pmg-log-tracker.git;a=summary

 

[Teucrus]

Hello,

Thank you for your reply. I attempted to read the source code previously but I am a bit rusty with Rust
From the first link I can see you have put a lot of though to it.
Would it be possible to make pmg-log-tracker a standalone thing?
Or somehow, at the cost of the performance add an option to allow users to load bigger log sets to it?
The format you have, is very awsome, I was able to track down many issues with our mailer because of it.
I also want to use it to track things like mail traffic for specific users on large time scales to track if their mail traffic increases/decreases.
This is a good indicator for issues.
Anyway thank you again for your time and for the great software.

 

[dcsapak]

Would it be possible to make pmg-log-tracker a standalone thing?

it is already a standalone binary/git repo and reads from std syslog

Or somehow, at the cost of the performance add an option to allow users to load bigger log sets to it?

you can give a logfile manually with '-i' or simply modify your logrotate snippet to keep the syslogs longer

 

[Teucrus]

it is already a standalone binary/git repo and reads from std syslog


you can give a logfile manually with '-i' or simply modify your logrotate snippet to keep the syslogs longer

Sorry it was unclear of me. When I put a longer date range I get: "aborted by limit (too many hits)"
Is it possible for the user to select that limit from the pmg GUI?

Thank you.

 

[Teucrus]

By the way, when I run: /usr/bin/pmg-log-tracker from the cli, the output I get, does not make the same sense to me like it does when the results are in the GUI. I am guessing the GUI does additional processing to that output.

Can you outline the GUI's processing on how it matches the output from the cli?

 

[dcsapak]

the gui basically calls 'pmg-log-tracker -s STARTTIME -e ENDTIME -vv -l 2000' where the '-l 2000' is the limit (you can omit that if you call it yourself
(check pmg-log-tracker --help for more info)

the rest of the matching is done here: https://git.proxmox.com/?p=pmg-api....44436de4c29c2462aea76525;hb=refs/heads/master

 

[Teucrus]

the gui basically calls 'pmg-log-tracker -s STARTTIME -e ENDTIME -vv -l 2000' where the '-l 2000' is the limit (you can omit that if you call it yourself
(check pmg-log-tracker --help for more info)

the rest of the matching is done here: https://git.proxmox.com/?p=pmg-api....44436de4c29c2462aea76525;hb=refs/heads/master

This is great. Thank you for all the info