Hy!

We have now about 10 Linux servers (SLES).

Whats bad about that ?

I just do not have any fun in controlling all the log files 10 * messages, 10 * warn .....

Does anybody of you know a tool with which i can make this job more easy ????

My first idea was that I set up a central management server ??? What do you think about that idea ?

Thanks!

Hi,

If you are talking about syslog related logfiles/messages, this is one sollution (in a nutshell):

Send all messages from all 10 machines to one server (could be a dedicated machine or on of the 10 that can handle the extra load). This functionality is already present in syslog, 'just' need to set it up.

Get a tool that checks the logfile(s) and reports anomalies. Logcheck being one of those tools.

If set up correctly you will be notified when something is not ok.

Hope this helps.

Thanks for your answer!

But what tools would help to analyse the logs ?

No problem

I already mentioned logcheck, which can help you.

Personally I use logcheck and make sure that all facilities have their own logs and within that all priorities have their own log (ie: kernel.0.log -> kernel.7.log, mail.0.log -> mail.7.log etc).

I also have an allmessages file, which is used by logcheck. Logcheck sends me mail if it is triggered by a 'suspicious' logentry. Although logcheck has a set of predifined triggers, I had to spend a lot of time to tailer/add these.

There must be other analyse tools around, although I don't have any experience with them.

Hope this helps.

Thank you!

We now use logmail for 5 linux server.

It really works nice.