I would like to monitor syslog logs on few dozens of linux servers. In ideal world I'd prefer pull method where central monitoring server collects once per day logs from all machines via ssh, applies common and per-server rules and reports about any unexpected log entries.

Do you have any suggestions?

I would prefer not to use centralized syslog server.

I've looked at ossec, again I would prefer to use ssh for all the communication and would prefer to avoid installing any additional tools on monitored servers

  • what about Splunk? – gravyface Apr 21 '11 at 21:36
  • scratch that: looks like Splunk uses syslog for log collection. – gravyface Apr 21 '11 at 21:42
  • +1 Splunk. It uses whatever you want and can forward to a remote server or multiple remote servers. – dmourati Apr 21 '11 at 22:26
  • Cool. Didn't know it would watch directories. – gravyface Apr 21 '11 at 22:34
  • just curious, why avoid syslog network capabilities? it was designed for this specific usecase. – Javier Apr 21 '11 at 22:38

I'm not sure of any turn-key application/solution for this but you could easily use rsyslog on your central monitoring server with the imfile module, which can monitor (and alert via ommail module and conditionals) on arbitrary log files that could be pulled in from your Linux servers via rsync and cron.

I'm using rsyslog as a central syslog server and using ommail to send me alerts on various events from my edge firewall, Squid proxy, core switch, etc. Works well.

  • thanks! that sounds interesting. that's central monitoring done the way i like... where i can pull the data rather than expose logging server. – pQd Apr 21 '11 at 22:17
  • Make sure you get one of the later builds/packages: Ubuntu 10.04.2LTS still ships with rsyslog 4.2, and there's a bug in ommail ($ActionExecOnlyOnceEveryInterval doesn't work, which throttles the amount of emails you get per time interval) that was fixed in 4.4.x I believe. – gravyface Apr 21 '11 at 22:23

Use Splunk. It has several ways to collect and index logs. You can set a cron job to pull the server logs into monitored directories, i.e. /var/log/splunk-logs/{server1, server2, etc}. This is a bit more work then just using syslog, but should be doable.

  • ah, did not know that. – gravyface Apr 21 '11 at 22:33

If you're wanting some kind of script you could use this http://paste.broner.org/126 (could easily be more dynamic with catching user input, or more elegantly getops). If you don't allow for root to ssh to your hosts from the 'source' machine you could run a script based on the filtering locally on each host, and setup a cron job to watch the logs. Put the dumped new entries to a specific location and have the 'source' machine check that directory via cron, pickup the files, and remove them once copied.

This is a huge work around for not using syslog-ng, or some other syslog server. Is there a reason why you choose to not use one?

Edit: you could also use uuencode, and mail, to mail the files to an address as well if that would be more preferred.

  • Bit kludgy, imo. – gravyface Apr 21 '11 at 22:05
  • thanks; i was also thinking about hacking my own script to do the monitoring but first want to see what's out there already available. – pQd Apr 21 '11 at 22:16

Logwatch and Swatch are commonly available tools, and are even installed by default on some Linux distributions. You could install this on each server. This keep a running tail on the logs so that any critical events (eg stuff dying, hack attempts, ssh failures, etc) could be alerted to you immediately via email or some other delivery mechanism.

If you need to avoid installing tools on each monitored system, you could write up some rsync scripts to grab the /var/log directories and sync to a local directory on the central server. Then tell swatch/logwatch to parse those.

  • thanks; but then i guess i'll need to have separate filtering config for each server. i'm looking for something that is supporting multiple servers [and common filtering rules] by design. – pQd Apr 22 '11 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.