Topic: Centralized Log grabber/viewer

[Sylvain]

Hello,

I would like to start a new topic.

On our network we have many Linux box most of them are Mitel SME Servers. They are mostly web servers and MySql servers. It generate tons of log we need to track and remove from these server. It need to grab log from /var/log and import it in a MySql database. Then we must be able to query and display them through a  web interface, then if we can set alerts through email this "valuable application" would give us what we are looking for.

On your network, do you have an application running, something similar to our requirement? Id so, feel free to introduce us to it.

Thank You!

[Jon Blakely]

Sylvain,

Try this link. I think you will find it is exactly what you are after

http://www.linuxsecurity.com/feature_stories/feature_story-138.html

Jon

[Dave D]

I have been thinking about this as well.

I did some Googling and found this:

http://www.campin.net/newlogcheck.html

I am looking to build a Gentoo Linux box (my preferred flavour) in the next couple of weeks to act as a centralized loghost for SME as well ipCop and some other things.

Dave

[Sylvain]

I really like the idea of having them all in one place and see them through a web interface. I did check out syslog-ng and it look like it do reports and alerts but in a text files.

Being able to create reports from a web interface is really what we are looking at. Said so, I will restart  all our Linux syslog server with the -r for sending log to remote server and deploy NTSyslog for NT servers than I guess I should use Msyslog from http://sourceforge.net/projects/msyslog/

It seem like there is not many peoples who did deploy this yet, it's strange, isn't it?

[Sascha]

As a suggestion, why not simply run a tail -f logfile >> newlogfile entry. This would allow you to create your own log files. You could even grep this for certain entries... ie tail -f logfile | grep xyz >> newlogfile

Just an idea. Naturally you would need to find a way of getting it to load at startup, but there are already various ways of doing that.

Sascha