350 reputation
114
bio website
location France
age
visits member for 3 years, 9 months
seen Jan 20 at 21:57

Jan
13
accepted How to rename and join an elasticsearch server preserving data?
Jan
13
answered How to rename and join an elasticsearch server preserving data?
Jan
13
awarded  Popular Question
Jan
9
revised How to rename and join an elasticsearch server preserving data?
deleted 6 characters in body
Jan
9
asked How to rename and join an elasticsearch server preserving data?
Jan
1
comment Reverse DNS Lookups
This would work if the hosts are always-on. If the machines are also laptops then some (or a lot, depends on the activity) may get lost.
Dec
27
awarded  Popular Question
Nov
25
asked How to accommodate two sets of NTP servers
Sep
16
awarded  Self-Learner
Sep
8
awarded  Popular Question
Jul
17
accepted Changing password expiration policy at next password change
Jul
16
asked Changing password expiration policy at next password change
Jul
2
awarded  Curious
Jun
14
comment how to manage the whole /var/log for centralization?
I use splunk extensively, including forwarders. This is a fantastic tool.
Jun
13
accepted how to manage the whole /var/log for centralization?
Jun
13
comment how to manage the whole /var/log for centralization?
I will end up building a wrapper around text File Input Monitor to dynamically create configuration entries for each non-rsyslogd-managed file. Thanks!
Jun
13
comment how to manage the whole /var/log for centralization?
@JennyD: I do not know about your case but mine, details aside, is that I need to have these logs centralized without relying on the admins to always configure the forwarding - and a technical solution to that.
Jun
13
comment “POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?
@Iain: true, but having experienced that on many servers when such attacks became fashionable years ago I saw a drastic reduction (almost to zero) of this noise in the logs.
Jun
13
comment how to manage the whole /var/log for centralization?
@JennyD: no, this is not a fairly urgent issue. The systems are handled by various people (they do know what will appear), the servers are peripheral helpers, not key servers etc. The background story is long but the TLDR; version is that it would be good to be able to feed these various logs to splunk> in a reasonably simple way, with the constraints mentioned in my question.
Jun
13
comment “POSSIBLE BREAK-IN ATTEMPT!” in /var/log/secure — what does this mean?
Another solution is to move the ssh server to a port other than 22. That should remove most of the messages (and break the standard "22/ssh", whether it is important or not depends on your system)