Re: A tool like "logwatch" for a log server

On Fri Sep 14, 2007 at 08:32:57 -0700, Seth Mattinen wrote:

> Sort of related question: Does anybody (when aggregating logs to a dedicated
> logging host) stop logging to the local disk, or do you still do both local and
> remote logging?
>

  I've done it both ways round in the past. There's no ideal solution  I think.

  Having things local is useful if you break networking, or your  central loghost fills up though!

  I'd be interested in any interesting solution to this problem though,  right now we use syslog-ng to send logs to a central machine. Those  messages pass through a pipe to immediately alert upon a couple of  common patterns (eg. failing raid) and then the logs get dumped to  MySQL.

  200ish machines take up a lot of space, so the next job is to start  to filter the logs prior to database insertion - but I've not found  anything that will do the job neatly yet ..

Steve

-- 


-- 
To UNSUBSCRIBE, email to debian-isp-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org