LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 01-29-2008, 04:17 AM   #1
humbletech99
Member
 
Registered: Jun 2005
Posts: 374

Rep: Reputation: 30
Logging - Text File to Syslog


I have some databases which log to a flat text file and I don't think that this version can log to syslog, so I'd like to stream the log file into syslog myself. I figure that keeping something like this running should work:
Code:
tail -f /path/to/logfile | logger
or
Code:
logger -f /path/to/logfile
My question is whether or not there is a better way of doing this?

I think that if this process is restarted, and the logfile is always quite large, that it will read at least some of it again and duplicate that information into syslog which I'd like to avoid.

Is there a better way, some program perhaps that will remember it's position in the logfile and if crashed/restarted will pick up again from that exact point without missing anything or reinserting the same log information again, possibly also handling log truncation or rotation? Does logger -f have an intelligence on this?
 
Old 01-29-2008, 04:39 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
if you use syslog-ng you can just use a file source (or a fifo source) and read right from it. you may have issues about rotation and such, totally depends how the output file itself works. i can't see too much wrong with your tail option again, but then you'd need to restart that if the log is rotated otherwise it'll just keep reading the same inode if the filename is changed, rather than reading the new file.

you might also like somethign swishy like splunk, which will make this al very web2.0 and slick.
 
Old 01-29-2008, 05:10 AM   #3
humbletech99
Member
 
Registered: Jun 2005
Posts: 374

Original Poster
Rep: Reputation: 30
ah yes, thanks, I am using syslog-ng and forgot that you can use this to source a file... oh except that it turns out this is a pathetic RHEL system which does not have syslog-ng and it doesn't look like it's in the 3rd party repos either, more trouble than it's worth to mess around on a very important database server...

I would try splunk but it's not free, the free thing they give away is crippled.

Looks like the tail logger idea is the best one at the moment...

what's I'd like is a way of more intelligently tailing the file into syslog...
 
Old 01-29-2008, 07:47 AM   #4
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
the free version still generally can do more than syslog-ng, it's not cluster capable, but that was never somethign you mentioned...

for syslog-ng i use the rpm's from Dag Wieers repositories, just pick the EL4 / EL5 ones and it'll drop right in, SElinux permitting
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
syslog-ng is not logging coreno Linux - Software 4 09-08-2007 02:13 PM
Using syslog-ng to for application logging nathan2225 Programming 1 05-21-2007 11:55 AM
Logging/syslog s0n|k Linux - Newbie 2 03-13-2006 08:36 PM
Logging firewall with syslog-ng? RecoilUK Linux - Security 1 08-06-2005 05:28 PM
syslog running but not logging tantric Linux - Security 1 10-15-2003 08:24 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 07:42 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration