Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I like the idea of combination of send (sending to syslog aggregator) and fetch (fetching logs from clients) design.

(More in wonderful doc http://www.ranum.com/security/computer_security/archives/logging-notes.pdf)

However, if anybody uses this, what would be best tips to processes sucked logs?

Example: I would collect logs every hour. Normal send part works without problem. Then I would like to know:

  • which log is in fetched part and not in already received (lost log message?)
  • which log is not existing in fetched logs but presented in already received logs (modified logs on client?)

It would depend on how one manages logs on central log server, if using a correlation etc...

Inserting into a DB?

share|improve this question
I feel dirty reading this. –  ceejayoz Mar 15 '12 at 20:59
Can we please not use the term "blow and suck" on this site? –  joeqwerty Mar 15 '12 at 22:35
I have thought it is normal naming, nothing vulgar :D –  Jiri Xichtkniha Mar 15 '12 at 23:04
@JiriXichtkniha no, most people call the two Push and Pull instead of Blow and Suck. –  Zypher Mar 15 '12 at 23:20
The attached pdf seems to use both sets of terms. Perhaps Ranum was going for shock value. –  Stefan Lasiewski Mar 15 '12 at 23:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.