Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm planning a centralized log server for 200+ Linux boxes, rsyslog on both the client and server side. Here are my requirements:

  • Do not log anything locally on Linux boxes and send everything to centralized log server.
  • In case the centralized log server crashes, then

How do I tell the clients to start logging locally? Or

What would be the best option in case of failed central log server?

share|improve this question
    
Who logs the loggers? –  Dan Oct 22 '13 at 12:33
add comment

1 Answer 1

up vote 1 down vote accepted

The way I've set up redundant syslog servers is by using a load balancer and shared file storage. I basically have all of my endpoints and my syslog servers log to /mnt/logs which is a shared SAN storage. Both servers have that mounted and can write to it so no matter which server is up, the logs will always be in the same place. I have some additional details in my previous post which can be found here.

Sorry, I only answered part of your question in my initial post. As far as sending all logs to the central location, I just modified the rsyslog.conf and added this line.

auth.*;authpriv.*                               @my-syslog-server:514

In my example, I just want the auth and authpriv logs, you can do . if you want everything. I'd recommend keeping the local logging as well just in case. No reason to modify everything else when the system is made to keep logs for ~1 week depending on how it's configured. As far as Windows goes, I use nxlog as an agent and send all logs via it. You can also use Snare as it's a little simpler to setup if you are not used to nxlog.

share|improve this answer
    
Thanks. That's what I'm going to do. –  Sharma Oct 22 '13 at 14:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.