335 reputation
112
bio website
location France
age
visits member for 3 years, 7 months
seen 10 hours ago

Sep
16
awarded  Self-Learner
Sep
8
awarded  Popular Question
Jul
17
accepted Changing password expiration policy at next password change
Jul
16
asked Changing password expiration policy at next password change
Jul
2
awarded  Curious
Jun
14
comment how to manage the whole /var/log for centralization?
I use splunk extensively, including forwarders. This is a fantastic tool.
Jun
13
accepted how to manage the whole /var/log for centralization?
Jun
13
comment how to manage the whole /var/log for centralization?
I will end up building a wrapper around text File Input Monitor to dynamically create configuration entries for each non-rsyslogd-managed file. Thanks!
Jun
13
comment how to manage the whole /var/log for centralization?
@JennyD: I do not know about your case but mine, details aside, is that I need to have these logs centralized without relying on the admins to always configure the forwarding - and a technical solution to that.
Jun
13
comment “POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?
@Iain: true, but having experienced that on many servers when such attacks became fashionable years ago I saw a drastic reduction (almost to zero) of this noise in the logs.
Jun
13
comment how to manage the whole /var/log for centralization?
@JennyD: no, this is not a fairly urgent issue. The systems are handled by various people (they do know what will appear), the servers are peripheral helpers, not key servers etc. The background story is long but the TLDR; version is that it would be good to be able to feed these various logs to splunk> in a reasonably simple way, with the constraints mentioned in my question.
Jun
13
comment “POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?
Another solution is to move the ssh server to a port other than 22. That should remove most of the messages (and break the standard "22/ssh", whether it is important or not depends on your system)
Jun
13
revised how to manage the whole /var/log for centralization?
extra info, clarification
Jun
13
comment how to manage the whole /var/log for centralization?
Thanks for the comments, but as mentioned in the comment of the first answer I do not know which files will be present in /var/log - this is why I need to handle it as a whole. I will stress and highlight this in my question.
Jun
13
comment how to manage the whole /var/log for centralization?
Thanks - but the Text File Input Monitor module forces me to handle each file separately. I do not know which files will be created, this is why I wanted to handle /var/log as a whole (including all the changes: files appearing and disappearing)
Jun
13
comment how to manage the whole /var/log for centralization?
@Iain: that would have been the easiest solution (and directly implemented in splunk from the receiving side) but all of the logs are not created by rsyslog. Some are updated by the application itself (like the example I gave - Apache) and I also cannot assume that I will know all the services which log to a file in /var/log.
Jun
13
asked how to manage the whole /var/log for centralization?
Jun
3
asked Cisco UC Integration for Lync does not switch back Lync status after a call
Apr
11
comment how to unify package installation tasks in ansible?
The zoo is fortunately only two animals large but this is the lowest number I can go to :)
Apr
10
accepted how to unify package installation tasks in ansible?