Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a multitier application, consisting of many servers on different subnets (each one of these subnets dedicated for the application purpose they provide with no other servers independent of the application). Those servers are windows, debian, freebsd and in the future there might be others too.

I want to have a Centralized logging mechanism for my systems. Problem is I want the data collected to a DMZ first and then accessed by the log server that will be on a different local network subnet.

I also need logging for my network devices, but this could be an entirely different logging server for all I care (though it would be better if this was not the case).

How would you impelement this type of logging? The architecture is tiered like this for security purposes and will not change.

I have already seen Scribe and Logstash as viable solutions. Would you recomend them for an undertaking such as the one described earlier?

Is the implementation of scripts using ssh mechanism the way to go?

share|improve this question
What do you mean "network layer logging"? Like network equipment monitoring/logging; or you want to capture packets?? Also Splunk is probably what you're looking for with the wide variety of systems. – Chris S May 2 '13 at 12:37
up vote 3 down vote accepted

You can do this with any of the modern syslog servers (my recommendation would be syslog-ng because I'm familiar with it, but rsyslog is another option).
Pretty much every system support syslog in some way (every professional-grade router/switch I've worked with does, Unix machines do, and I believe Windows can even send event log messages to syslog servers), which makes it a pretty good option.

The syslog protocol is traditionally unsecured UDP datagrams, but modern syslog servers have TCP support, and I know syslog-ng also supports SSL/TLS.

As far as how you collect the log data, implementation strategies vary.

One option is to simply allow all your hosts to connect to the syslog server and have them send their log messages there. This is relatively simple, but potentially less secure (you need to punch lots of firewall holes, or allow the whole universe to talk to your log server).

Option 1 - One log server

Another option is local log aggregators that forward to a central log server (similar to the architecture you describe in your question). This is generally considered to be a better option for two major reasons:

  • It's easier to secure
    The central log server only needs to accept connections from "authorized" clients, and the local log servers only need to accept connections from their local network.

  • It offers you some redundancy
    If the central log server is down for maintenance you are still collecting logs on the local servers, and they can be forwarded along when the central server is available again. enter image description here

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.