Re: Secure remote syslogging?

[Jamie Penner <jpenner@nisa.net>]

or, if using syslog-ng, do this for each logfile type in your config file:

destination syslog { file("/var/log/serverlogs/$HOST/syslog" owner("root") 
group("adm") perm(0640)); };


that way, each server will have unique files in their own directories.




> I'm assuming you mean maintaining a separate log per machine that you collect
> logs for?  I wouldn't bother with that, personally.  Grep is a great tool...
> If you *really* generate a lot of log information and need to analyze it in
> greater detail, then dumping it into a database at the back end could be
> warranted.  For most sites, though, grep is quite sufficient, especially if
> you combine it with swatch -- which can look through your log files for
> particular events that you define, and then email/page you when/if they
> occur.  A simple, but quite usable intrusion detection system of sorts...