LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Enterprise Linux Forums > Linux - Enterprise
User Name
Password
Linux - Enterprise This forum is for all items relating to using Linux in the Enterprise.

Notices

Closed Thread
 
Search this Thread
Old 01-13-2009, 01:23 PM   #1
steve.goldner
LQ Newbie
 
Registered: Jun 2008
Location: North Carolina, USA
Distribution: CentOS, RHEL 4
Posts: 6

Rep: Reputation: 0
syslog to central server and store logs in separate host directories


Hello all!

I am setting up a central syslog server to accept logging from multiple production servers. I have syslog configured and functional. What I would like to do next is setup separate directories on the logging server(central) for each of the production servers(remote). For example:

remote client:
hostname - pserver1
snippet from /etc/syslog.conf
Code:
authpriv.*		@loghost # which is the central logging server
Now, what I don't know how to do is configure the central logging server to put the messages from pserver1 into a directory like:

Code:
authpriv.*		/var/log/pserver1/secure
I know the above line is incorrect. What is the correct syntax to split the logging from different hosts to different files/directories?

Can't use syslog-ng because it is not supported in RedHat(all RHEL 4.x), therefore I need to use the standard syslogd.

Thanks!
 
Click here to see the post LQ members have rated as the most helpful post in this thread.
Old 01-13-2009, 03:41 PM   #2
FragInHell
Member
 
Registered: Sep 2003
Location: Sydney Australia
Distribution: Redhat, Centos, Ubuntu
Posts: 282

Rep: Reputation: 45
you can use standard Redhat syslog on the client and just compile syslog-ng or rsyslog on the central logging server. Thats what we did at my last company, that way the clients are not changed. We setup logging using rsyslog into a mysql DB. Just an Idea, sorry not sure about your syntax problem.
 
Old 01-14-2009, 08:38 AM   #3
steve.goldner
LQ Newbie
 
Registered: Jun 2008
Location: North Carolina, USA
Distribution: CentOS, RHEL 4
Posts: 6

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by FragInHell View Post
you can use standard Redhat syslog on the client and just compile syslog-ng or rsyslog on the central logging server. Thats what we did at my last company, that way the clients are not changed. We setup logging using rsyslog into a mysql DB. Just an Idea, sorry not sure about your syntax problem.
Thanks for the suggestion, however, RHEL 4 doesn't support syslog-ng nor rsyslog(RHEL5). So, my options are limited. Any other ideas?
 
Old 01-14-2009, 09:12 AM   #4
TB0ne
Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 14,592

Rep: Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559
Quote:
Originally Posted by steve.goldner View Post
Thanks for the suggestion, however, RHEL 4 doesn't support syslog-ng nor rsyslog(RHEL5). So, my options are limited. Any other ideas?
RHEL4 runs syslog-ng just fine...compile it from source, if you can't find it on a repository.

However, only your central syslog server needs to be running syslog-ng. Your other servers (Solaris, AIX, Linux, etc.), can run the 'regular' syslog daemon. Set up syslog-ng to put logs from different IP addresses to different files, named with their associated FQDN's.
 
Old 01-14-2009, 09:28 AM   #5
steve.goldner
LQ Newbie
 
Registered: Jun 2008
Location: North Carolina, USA
Distribution: CentOS, RHEL 4
Posts: 6

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by TB0ne View Post
RHEL4 runs syslog-ng just fine...compile it from source, if you can't find it on a repository.

However, only your central syslog server needs to be running syslog-ng. Your other servers (Solaris, AIX, Linux, etc.), can run the 'regular' syslog daemon. Set up syslog-ng to put logs from different IP addresses to different files, named with their associated FQDN's.
I agree, syslog-ng is the way to go. The issue that I have is company policy. I can't use non-RedHat rpms or source for a variety of reasons.
 
Old 01-14-2009, 10:03 AM   #6
DotHQ
Member
 
Registered: Mar 2006
Location: Ohio, USA
Distribution: Red Hat, Fedora, Knoppix,
Posts: 542

Rep: Reputation: 33
Quote:
Originally Posted by steve.goldner View Post
I agree, syslog-ng is the way to go. The issue that I have is company policy. I can't use non-RedHat rpms or source for a variety of reasons.
I was also going to suggest syslog-ng. To bad your company can't see that once in awhile an exception to the rule is okay.
I see you like Cent-OS. Would they let you run syslog-ng on a Cent-OS box and simply use the syslog daemon to send the traffic to the log server? As you can see from the other posters, it is a solution that works.
 
Old 01-14-2009, 10:04 AM   #7
TB0ne
Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 14,592

Rep: Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559
Quote:
Originally Posted by steve.goldner View Post
I agree, syslog-ng is the way to go. The issue that I have is company policy. I can't use non-RedHat rpms or source for a variety of reasons.
Well, you can either fight the (rather dumb) company policy, or homebrew your own solution. You could write a program to do some filtering on the single, massive-combined syslog file, and parse it down every few minutes into separate files. But that would require you writing code (hey, that would be SOURCE CODE), which is against your company policy. And at the end of the day, all it would do is replace one set of source code with another, which doesn't function as well.


'Regular' syslog daemons pump things to one file..that's it, that's all they were ever designed to do. That's why syslog-ng came about.
 
Old 12-08-2011, 12:26 AM   #8
Satyaveer Arya
Senior Member
 
Registered: May 2010
Location: Dehradun, Uttarakhand, India
Distribution: RHEL, CentOS, Debian, Oracle Solaris 10
Posts: 1,413

Rep: Reputation: 303Reputation: 303Reputation: 303Reputation: 303
Hello,

Do RHEL 5.3 support syslog-ng rpm ?
 
0 members found this post helpful.
Old 12-08-2011, 11:36 AM   #9
TB0ne
Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 14,592

Rep: Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559
Quote:
Originally Posted by Satyaveer Arya View Post
Hello,
Do RHEL 5.3 support syslog-ng rpm ?
Do not reopen threads that are TWO YEARS OLD, and hijack them with your own question. Open your own thread.

And again, RHEL should have syslog-ng in the repositories that you have available via the RedHat Network, since you're paying for support, right? If you're not, you can (as stated years ago), compile syslog-ng from source. And if you already HAVE an RPM for syslog-ng, why not just *try* to install it?
 
2 members found this post helpful.
Old 02-23-2012, 07:57 PM   #10
SlCKB0Y
Member
 
Registered: Oct 2001
Location: Sydney, Australia
Distribution: Debian Unstable
Posts: 279

Rep: Reputation: 36
What? It's better that every person NOT search and instead create a new thread whether one exists or not?

At what age does your holiness deem a thread to old to reply to? 6 months? 1 year? 18 months? 5 hours?

PLEASE DO tell us, so we will know in future and won't frustrate you in future.
 
1 members found this post helpful.
Old 02-24-2012, 09:28 AM   #11
TB0ne
Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 14,592

Rep: Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559Reputation: 2559
Quote:
Originally Posted by SlCKB0Y View Post
What? It's better that every person NOT search and instead create a new thread whether one exists or not?
At what age does your holiness deem a thread to old to reply to? 6 months? 1 year? 18 months? 5 hours?
PLEASE DO tell us, so we will know in future and won't frustrate you in future.
Since you're not paying attention, and/or didn't bother to read the thread, the follow-up question that re-opened this old thread didn't relate to the original topic. New question = new thread. Read the LQ Rules. If you don't like them, tell the moderators.
 
Old 04-07-2012, 02:26 PM   #12
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,305
Blog Entries: 54

Rep: Reputation: 2857Reputation: 2857Reputation: 2857Reputation: 2857Reputation: 2857Reputation: 2857Reputation: 2857Reputation: 2857Reputation: 2857Reputation: 2857Reputation: 2857
Quote:
Originally Posted by SlCKB0Y View Post
At what age does your holiness deem a thread to old to reply to? 6 months? 1 year? 18 months? 5 hours?
This doesn't automagically go for all topics but I'd say ninety nine per cent of the questions asked on LQ have a short TTL, usually measured in days. So responding a couple of months afterwards, and especially with a rebuke like this is uncalled for. After your hiatus of about three years two out of your three posts resulted in a collision. I'll leave it at this but I suggest you review the way you post.
 
  


Closed Thread


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Central Log Server using syslog-ng sakthi.s Linux - Security 3 12-26-2007 05:04 PM
central server log / databased . . syslog-ng maybe? sir-lancealot Linux - Server 2 08-28-2007 11:55 AM
syslog server receives logs from remote device dwarf007 Linux - Security 3 01-24-2007 07:49 AM
Syslog-ng central logserver is dropping logs humbletech99 Linux - Networking 2 06-22-2006 03:09 AM
Configure SLES9 Server as a central log host gcw123 Linux - Software 4 12-29-2004 06:31 AM


All times are GMT -5. The time now is 11:36 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration