Re: A tool like "logwatch" for a log server
On Fri Sep 14, 2007 at 08:32:57 -0700, Seth Mattinen wrote:
> Sort of related question: Does anybody (when aggregating logs to a dedicated
> logging host) stop logging to the local disk, or do you still do both local and
> remote logging?
I've done it both ways round in the past. There's no ideal solution
Having things local is useful if you break networking, or your
central loghost fills up though!
I'd be interested in any interesting solution to this problem though,
right now we use syslog-ng to send logs to a central machine. Those
messages pass through a pipe to immediately alert upon a couple of
common patterns (eg. failing raid) and then the logs get dumped to
200ish machines take up a lot of space, so the next job is to start
to filter the logs prior to database insertion - but I've not found
anything that will do the job neatly yet ..