This produces the easiest-to-read diff IMO:
diff -btu [oldfile] [newfile] > patchfile
-b = ignore blanks
-t = preserve source indentation
-u = 3 lines of context with the + and - in front of changed lines

But the -t option interferes with proper patch application, so just use:
diff -u [oldfile] [newfile] > patchfile
…where oldfile is the file you want to patch, and newfile is the file with the changes you want to apply.

patch -b -p0 < patchfile
-b = make a backup

If you are asked for the patch filename - you probably don’t have the depth set right with -p.  Try increasing it.

If you get the message “Reversed (or previously applied) patch detected!”, somebody messed with your stuff between creating the patch & applying it, OR you did the diff backwards (common Monday morning mistake.)

I shortened some questions and answers to better fit on the page; see original data if you are concerned about potential shifts in meaning. In many cases, I re-ordered the answers in a way that makes sense to me. Again, please see the original data if this concerns you.  Not all data has been graphed.  Graphs created in OpenOffice Calc.  I would have rather used Gnuplot, but I preferred the horizontal bar chart style & gnuplot can’t do that yet without a lot of gymnastics.

PostgreSQL JTA - Graphs

In Perl, this is a no-brainer to me - the NULL value would be ‘undef’, and I could write something like:

$value = $default if (! defined $value);

So, after a bit of struggling, I found out that the ‘None’ object is returned when a value is NULL in python.

To determine whether you’ve got a NULL, you write something like:

if $value is None:
    $value = $default

Generally speaking, Python considers an undefined object to be a rare occurrence.

Other fun things we discussed at the meeting:
Cisco::Reconfig
trapgen
logger
logwatch

Thanks for the lively discussion!

[edit] podcast!

[edit] Clarification of two items from the podcast:
- multiline messages do indeed come in multiple packets. There is a message counter that increments for each message, so you could use the host name + message counter to match up multi-line messages. For what I’m doing, the important part is in that first line, so the payoff isn’t worth the investment.
- re hypens in the mnemonic field of the system message: I went back through and wasn’t able to find any examples of this, so I retract my statement. (I do have examples of system messages with hyphens in the facility field.)

Part 1: Set up your log host.

Step 1: before editing any of the files discussed below, be sure to back them up, e.g.:
cp /etc/syslog.conf /etc/syslog.conf.dontmessthisup

Step 2: edit /etc/syslog.conf to include this:
#router logging
local6.debug                    /var/log/cisco.log

This means “send all messages from facility local6, with a priority of debug or greater, to /var/log/cisco.log”.

(Note that the default facility for Cisco is local7; if you want/need to use the Cisco default, change the above accordingly.)

Step 3: create the log file I specified above:
sudo touch /var/log/cisco.log

Step 4: make syslog listen to messages from remote machines:
edit /etc/default/syslogd to include the -r option:
SYSLOGD="-r"

Step 5: restart the syslog daemon:
sudo /etc/rc2.d/S10sysklogd restart
(or look up the process id using ps -ef, and kill -HUP it; or pkill -1 syslogd…  your choice.)

Step 6: test it:
logger -p local6.debug "is this working?"

cat /var/log/cisco.log, you should see the line above.

Now, we have a problem: we also see the message in some of the other log files in /etc/syslog.conf (such as /var/log/syslog, /var/log/messages, and /var/log/debug).
We don’t want the messages from the router mixed in with the system messages (pet peeve alert)!  Put in exceptions for local6 anywhere we have an *.whatever, like so:

*.*;local6.none;\
auth,authpriv.none        -/var/log/syslog

Restart the syslog daemon again.

Test it:
for each in debug info notice warn err crit alert emerg panic
do
logger -p local6.${each} "this should only go to cisco.log - ${each}"
echo done with ${each}
done

Check /var/log/cisco.log, /var/log/syslog, /var/log/debug, and /var/log/messages - messages should only be in cisco.log.

—
Part 2: Configure your router to send messages to the log host.
config t
logging [ip address of your ubuntu box]
logging facility local6
logging history [severity]
logging on

<0-7>          Logging severity level
emergencies    System is unusable                (severity=0)
alerts         Immediate action needed           (severity=1)
critical       Critical conditions               (severity=2)
errors         Error conditions                  (severity=3)
warnings       Warning conditions                (severity=4)
notifications  Normal but significant conditions (severity=5)
informational  Informational messages            (severity=6)   <--
debugging      Debugging messages                (severity=7)

Normally I stick with informational (sev=6); debugging is a huge amount of info.

Compare the logging buffer on your router (”sh logging”) with the file on your log server;  messages since you made the change should also be going to the server.  If not, make sure you can reach the log server from the router, and that port 514 isn’t blocked anywhere.

—
Part 3: Rotation
Once that’s working, set up the log rotation.
Add this to /etc/logrotate.conf, below the “system-specific logs may be configured here”
/var/log/cisco.log {
missingok
compress
notifempty
daily
rotate 7
size 500k
}

You may need to tinker around with these settings depending on how many messages you’re getting a day.

Let me know what you’re planning to see in the comments!

-selena

Last night, an incredible number of people showed up to Code-N-Splode to hear about Git.

I was not at all prepared for that number of people, but grateful that a couple experts were on hand to help - Sarah Sharp, Audrey Eschright and Michael Schwern (and others) all contributed to the discussion. Thanks for all the great questions! I’m looking forward to Sarah’s advanced tutorial next month.

CTRL-F - page down; CTRL-B - page up; CTRL-D - put current line in the center of your screen

CTRL-R - Redo (plus COUNT for redoing a number of changes); ‘u‘ is for undo; ‘U‘ is for undoing all changes on a particular line

:set undolevels=NUM - number of changes saved in memory (can set to negative number if running out of memory

:split - split your current window into two; switch between windows with CTRL-W CTRL-W

!{cmd} - run a shell command, shows you the output and prompts you before returning to your current buffer; ‘:!‘ by itself runs the last external command; ‘:!!‘ repeats the last command; :silent !{cmd} eliminates the need to hit enter after the command is done; ‘:r !{cmd}‘ puts the output of $cmd into the current buffer.

Gabrielle and I are at it again, talking about Filesystem I/O and Linux at the Linux Plumbers Conference.  Mark Wong is the evil performance genius working with us behind the scenes, and a copy of what we brought to the conference today is here.

Takeaway: Set your read ahead buffer size higher in the kernel - maybe even 8MB.

See screenshot: