Tell me more ×

Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Push and Pull logging design - experience with processing sucked logs

up vote 0 down vote favorite

I like the idea of combination of send (sending to syslog aggregator) and fetch (fetching logs from clients) design.

However, if anybody uses this, what would be best tips to processes sucked logs?

Example: I would collect logs every hour. Normal send part works without problem. Then I would like to know:

which log is in fetched part and not in already received (lost log message?)
which log is not existing in fetched logs but presented in already received logs (modified logs on client?)

It would depend on how one manages logs on central log server, if using a correlation etc...

Inserting into a DB?

edited Mar 15 '12 at 23:20

Zypher♦
24.5k32871

asked Mar 15 '12 at 20:42

Jiri Xichtkniha
57519

I feel dirty reading this. – ceejayoz Mar 15 '12 at 20:59

Can we please not use the term "blow and suck" on this site? – joeqwerty Mar 15 '12 at 22:35

I have thought it is normal naming, nothing vulgar :D – Jiri Xichtkniha Mar 15 '12 at 23:04

@JiriXichtkniha no, most people call the two Push and Pull instead of Blow and Suck. – Zypher♦ Mar 15 '12 at 23:20

The attached pdf seems to use both sets of terms. Perhaps Ranum was going for shock value. – Stefan Lasiewski Mar 15 '12 at 23:34

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Name

Email required, but not shown

Post as a guest

Name

Email required, but not shown

discard

By posting your answer, you agree to the privacy policy and terms of service.

asked	1 year ago
viewed	159 times