I've read several QA on this site about monitoring servers, but I found out, that none of them centralises all the logs I want to watch.
To describe my situation:
- 10 linux hosts
- Using logwatch to monitor
- Apache
- Nginx
- Postfix / Dovecot
- MariaDB / MySQL
- Fail2ban
- SSHD
- Auth log / PAM
- Disk space
- Clamav
- Spamassassin
- General syslog monitoring
- Using mysqlreport to watch over configuration and resources usage
- Debsecan to monitor CVEs over installed packages
Logging isn't always centralised, as I do provide apache virtualhosts (like 100 of them), and each is using separate logging directory in chrooted environment.
Is there any centralised solution to gather these kind of information and provide web interface with custom rules (prioritise log analysis results) and possible email notifications?
I'm trying to calm down the situation, where I have to manually crawl through 30 to 100 e-mails each day, which is really impractical, and not very scalable.
Where issues I'm trying to find and solve each day are of three types, resources usage (configuration of services, quotas, network bandwidth, ...), application level problems (misconfigurations, segfaults, permission problems) and security problems (known CVEs, exploit patterns recognition, ...)