0

Currently I have a fairly large syslog-ng cluster setup that is my main log aggregation point. I have the need to be able to acknowledge certain logs and mark them as review for auditing purposes. Such as all failed sudo attempts. I can easily send the logs I am interested in to a specific folder, program, or email, but was wondering what you all use for the auditing aspect of it. Currently I send them to a MySQL DB and have it where it shows the logs and I can click acknowledge and add comments if I like. While this method works, I wanted something a little more professional looking. I've thought about tying them into an open source ticketing system and closing them out after review but wanted others opinions.

Thanks,

Eric

1 Answer 1

1

One option would be to feed your logs through logstash. Use a matching rule to match desired messages, and then use the logstash email output to create tickets for each message.

13
  • I did a quick POC of logstash and did like the searching/filtering capabilities of it. My main question on that is I'd still need another piece of software or script where I can track my actual approvals and the fact that I reviewed the logs, or does logstash have some sort of built in ticketing that I am not aware of?
    – Eric
    Aug 21, 2013 at 15:22
  • If you only want "unread" logs, you can use the AMQP output and create a little consumer which will remove messages after ACK. You can also try the ElasticSearch output and play with it to search/filter/update documents.
    – Kdecherf
    Aug 21, 2013 at 15:52
  • No, you'd need something like RT to track tickets. RT (and most other ticketing systems) can be configured to consume email from IMAP/POP3 mailboxes and create tickets based on those messages.
    – EEAA
    Aug 21, 2013 at 16:00
  • 1
    @Kdecherf - why counter-productive? Itis likely the fastest way to a solution, as nearly every org has some sort of email system already running, and doesn't require staff to write a custom AMQP consumer and maintain redis/RabbitMQ/etc.
    – EEAA
    Aug 21, 2013 at 16:42
  • 1
    @mdo - you seem to have missed the OP's desire to be able to add comments to specific messages. Again, this is something that would have to be written custom if one didn't want to install a ticket tracker. Additionally, he's doing this for regulatory reasons, and the regulatory bodies want to be able to see a full history of messages, comments, actions, and resolutions. Again, requiring custom logic. This is a perfect task for a ticket tracking software.
    – EEAA
    Aug 21, 2013 at 19:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .