logwatch, smartd, and a varying parameter (Seek_Time_Performance)

[Bruce Dawson]

Ben Scott wrote:
> Hello, list!
>
> CentOS 5
> kernel-2.6.18-8.1.8.el5
> logwatch-7.3-5
> smartmontools-5.36-3.1.el5
>
>   Running smartd to keep an eye on the hard drive.  Using logwatch to
> monitor logs for events of note.  Things like the following keep
> showing up in logwatch every night:
>
>  --------------------- Smartd Begin ------------------------
>  /dev/hda :
>     Prefailure: Seek_Time_Performance (8) changed to
>       252, 253, 252, 251, 252, 251, 252, 253,
>  ---------------------- Smartd End -------------------------
>
>   Checking the actual logs, I can confirm that smartd is reporting the
> Seek_Time_Performance value is varying between 251 and 253, inclusive.
>  From what I can tell with Google, this is fairly normal behavior.  As
> long as that parameter hovers around a fixed value, and does not trend
> steadily in either direction, things are good.
>
>   However, logwatch doesn't know that, and keep telling me about it.
> In my world, the point of logwatch is to only report things of
> relevance, and be silent if nothing interesting is happening.
>
>   It occurs to me that it would be really nice if logwatch could
> maintain a "tolerance" on this parameter, such that these normal
> variations are not reported, but any significant change would be.
>
>   My knowledge of logwatch is pretty limited, and unfortunately, I do
> not have the time to really dig into the internals of it.  Anyone know
> if logwatch already has features that could be used for this?  Either
> way, anyone know how one might go about doing something like this?
Its conceptually pretty simple. If you know perl regexp, then you know
logwatch. Its "fairly trivial" to write a filter. The problem is getting
it to not be replaced with the next version of logwatch when there's an
update.

BTW: My experience with logwatch goes back to RHL9, I have no idea how
it has changed since then.

--Bruce