Re: A tool like "logwatch" for a log server

[Steve Kemp <skx@debian.org>]

On Fri Sep 14, 2007 at 08:32:57 -0700, Seth Mattinen wrote:

> Sort of related question: Does anybody (when aggregating logs to a dedicated 
> logging host) stop logging to the local disk, or do you still do both local and 
> remote logging?
> 

  I've done it both ways round in the past.  There's no ideal solution
 I think.

  Having things local is useful if you break networking, or your
 central loghost fills up though!

  I'd be interested in any interesting solution to this problem though,
 right now we use syslog-ng to send logs to a central machine.  Those
 messages pass through a pipe to immediately alert upon a couple of
 common patterns (eg. failing raid) and then the logs get dumped to
 MySQL.

  200ish machines take up a lot of space, so the next job is to start
 to filter the logs prior to database insertion - but I've not found
 anything that will do the job neatly yet ..

Steve
--