LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 04-03-2007, 09:43 AM   #1
adymcc
Member
 
Registered: Dec 2006
Posts: 31

Rep: Reputation: 17
Syslog Monitoring


Hi all,

I'm wandering if someone could recommend some software that I can use to monitor a syslog-ng server for specific incoming faciility/priority events or even keywords and then display the output graphically in a network monitoring style.

I have seen that Hobbit can do something like this with client logs but I was hoping do do this directly on the syslog server as you cannot run hobbit client on routers etc.

I suppose I could use a hobbit client config on the server but Im not sure it has enough configuration to do what I need.
 
Old 04-03-2007, 10:25 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,397

Rep: Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963
Well what does a graphical output look like to you? you can configure syslog-ng itself to pick out what is deemed interesting using filters, so i'd suggest that's half of your battle. after that what do you want to achieve? if you want something *very* sexy, have a look at splunk.com which could totally replace syslog-ng too.
 
Old 04-04-2007, 05:33 AM   #3
*aj*
LQ Newbie
 
Registered: Apr 2007
Posts: 1

Rep: Reputation: 0
try eventloganalyzer dot com its got the reports your are seeking for.

john
 
Old 04-04-2007, 06:10 PM   #4
sickdude
LQ Newbie
 
Registered: Mar 2005
Distribution: red hat *, fedora core *, gentoo, slackware, ubuntu
Posts: 27

Rep: Reputation: 15
try using logwatch, it e-mails the output from your log files.

i use it for quite a while now and it works just perfect. i check my mail in the morning to see whats going on in the logs.
 
Old 04-05-2007, 02:07 AM   #5
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,397

Rep: Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963
many solutions work best at an optimum scale, and i can't think of much worse than being emailed logwatch output from 100 servers on a daily basis...
 
Old 04-05-2007, 03:23 AM   #6
sickdude
LQ Newbie
 
Registered: Mar 2005
Distribution: red hat *, fedora core *, gentoo, slackware, ubuntu
Posts: 27

Rep: Reputation: 15
there wasnt any saying about 100 servers so thats why i sugested logwatch.


if there are 100 servers try BigBrother
 
Old 04-05-2007, 03:35 AM   #7
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,397

Rep: Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963Reputation: 1963
oh no, i just tend to think from a larger scale. never impressed with what i've seen in bigbrother for syslog, splunk looks much more intelligent.
 
Old 04-11-2007, 04:02 AM   #8
adymcc
Member
 
Registered: Dec 2006
Posts: 31

Original Poster
Rep: Reputation: 17
We have around 150 servers to monitor, 80 *nix based. Thanks for the comments guys, we have been using Hobbit but have an increased need to monitor syslog from servers and hundreds of network devices.

It looks like Splunk will be the way to go but will probably have to find some way of getting exceptions to appear in Hobbit until I can find something better as the management need to see one easy to understand screen!
 
  


Reply

Tags
event, monitoring, network, syslog


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Syslog man_linux Linux - Security 3 03-06-2007 07:23 AM
LXer: Centralized Syslog Server Using syslog-NG LXer Syndicated Linux News 0 04-28-2006 06:21 PM
syslog-ng xlh3110 Linux - Software 4 02-21-2006 12:21 PM
*realtime* syslog monitoring/alerting with Rsyslog? TotalDefiance Linux - Software 3 11-01-2005 10:23 AM
syslog vs syslog-ng XaViaR Linux - General 9 06-17-2005 09:15 AM


All times are GMT -5. The time now is 03:24 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration