Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Logwatch is really useful for me, but I find it really tiresome to watch through all emails.

Is there any tool or solution that centralizes all the daily reports into one, and allows to easily navigate through them?



locked by HopelessN00b Mar 13 at 14:08

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off-topic by HopelessN00b Mar 13 at 14:08

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers 2

up vote 4 down vote accepted

We just setup a central logging server, then forward all syslog entries to that server and just run logwatch on that server.

Can logwatch in this case recognize different machines? – SyRenity Jan 2 '10 at 23:58
I mean, show in the output that logs are from different machines? – SyRenity Jan 3 '10 at 0:20
Yes, the hostname of the machine that generated the log message is in all syslog entries, as you can see by looking at any syslog-managed log file. – womble Jan 3 '10 at 2:56

To give an example of Zypher's answer, what I do is forward *.debug to @loghost on all nodes. The loghost node runs syslog-ng, which has the ability to split out by source system. (I presume other modern syslog replacements like rsyslog can do similar things.)

I have a sample syslog-ng.conf file for solaris, but changing it around to be for linux isn't too hard.

As you can see, we also forward all inbound messages to a single file. This lets us run nightly (or more frequently when required) reporting on a single place, but during debugging or forensic operations we can just look at the system in question.

Another benefit of logging all messages to a single file is that the sequencing of events across multiple systems is easier to determine as that file gets written by arrival time. This means your clocks don't have to be 100% synchronized in order to figure out a sequence of events (although of course that should always be a goal, no matter how unattainable it is).

Thanks, the clocks sync matter is something I didn't think about. – SyRenity Jan 3 '10 at 9:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.