[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: A tool like "logwatch" for a log server

On Fri Sep 14, 2007 at 08:32:57 -0700, Seth Mattinen wrote:

> Sort of related question: Does anybody (when aggregating logs to a dedicated 
> logging host) stop logging to the local disk, or do you still do both local and 
> remote logging?

  I've done it both ways round in the past.  There's no ideal solution
 I think.

  Having things local is useful if you break networking, or your
 central loghost fills up though!

  I'd be interested in any interesting solution to this problem though,
 right now we use syslog-ng to send logs to a central machine.  Those
 messages pass through a pipe to immediately alert upon a couple of
 common patterns (eg. failing raid) and then the logs get dumped to

  200ish machines take up a lot of space, so the next job is to start
 to filter the logs prior to database insertion - but I've not found
 anything that will do the job neatly yet ..


Reply to: