Hello,

I have a log file (/var/log/mir/messages) which has up-to-date information pouring in. I also have a php parser script, which parses for some information I like. This PHP script is supposed to give me real-time information when I look for it.

So, ideally, something like is what I'm trying to do. Tailing the realtime "feed" of messages, grepping what I want, and running a parser on it (don't even really need a parser to that because the grep is getting what I want, but I guess there's 2-3 types of information that the grep gives out, and I still want to segregate it, but anyways)

Now, I'm looking to ask the parser a question, and based on this realtime 'feed', I want it to answer me.

That's aspect one.
Aspect two, is I have about 10 boxes doing this same thing, and I want to get data from all of these boxes, and get a combined result when I ask the parser a question.

For this, I'm looking to log only /var/log/mir/messages to a central syslog server.


I'm looking for help in these.
First, I'd really appreciate it if someone can tell me what I'm trying to do with a parser can also be done in a different, less CPU intensive, and easier way.

Second, I'd really like to know how (if possible, step by step, I know, asking for a lot.. but you know.) I could do the remote logging. Google is good, man is good, but I'm just not able to get it going on CentOS 5.


A central server where all these 10 boxes log to, and I run the parser there. (That's if you like the parser idea.)


Thank you very much in advance.

Hello again.
So, no one willing to help?

If you wish to have all your boxes log syslog messages to ONE host:

1. on each of the 'client' servers, add an entry into /etc/hosts in the following format:

IP-Address FQDN hostname loghost

Be sure to add the 'loghost' at the end.

2. edit /etc/syslog.conf and add the following line:

*.info @loghost

3. restart syslog (i.e. /etc/init.d/syslog restart

There is still one more important step to do. Depending on what box you want to be the syslog 'server' you have to make sure you add the '-r' option to the syslog startup script.

Edit /etc/sysconfig/syslog and add the -r option so it is similar to below:

SYSLOGD_OPTIONS="-m 0 -r"

Restart syslog like stated above. You should be all set.

I don't know if there is any better way to parse everything, but i would look at an enterprise EM system (event management). Good luck

Thank you, noran.
Appreciate your help.