0

I've read several QA on this site about monitoring servers, but I found out, that none of them centralises all the logs I want to watch.

To describe my situation:

  • 10 linux hosts
  • Using logwatch to monitor
    • Apache
    • Nginx
    • Postfix / Dovecot
    • MariaDB / MySQL
    • Fail2ban
    • SSHD
    • Auth log / PAM
    • Disk space
    • Clamav
    • Spamassassin
    • General syslog monitoring
  • Using mysqlreport to watch over configuration and resources usage
  • Debsecan to monitor CVEs over installed packages

Logging isn't always centralised, as I do provide apache virtualhosts (like 100 of them), and each is using separate logging directory in chrooted environment.

Is there any centralised solution to gather these kind of information and provide web interface with custom rules (prioritise log analysis results) and possible email notifications?

I'm trying to calm down the situation, where I have to manually crawl through 30 to 100 e-mails each day, which is really impractical, and not very scalable.

Where issues I'm trying to find and solve each day are of three types, resources usage (configuration of services, quotas, network bandwidth, ...), application level problems (misconfigurations, segfaults, permission problems) and security problems (known CVEs, exploit patterns recognition, ...)

1
  • 1
    ELK is a great option.
    – EEAA
    Dec 16, 2014 at 12:48

1 Answer 1

1

Personally I use syslog-ng to forward syslogs and cacti with SNMP and syslog plugin , to achieve this functionality - this allows for prioritising/highlighting of specific event types etc, and emailing upon certain events etc.


Edit: if you do go down the cacti route, you may also find the threshold plugin useful; it can be configured to notify you when certain conditions (thresholds) are met, for example CPU usage going above a certain level, disk usage going above a certain level, etc - or your own custom thresholds of your own design.

Not the answer you're looking for? Browse other questions tagged .