recommend a free syslog...

[FreshPrince]

That has the ability to dump to a database (ie. mysql) and be able to analyze and make sense of the logfile.

played with the one made by solarwinds...pretty good, but not free 🙁 I need something like that 😉

Thanks!

-FP

 

[Nothinman]

Good luck finding one, most of the unix people I know (the vast majority using syslog are using it on unix) like things in plain text files because it's so easy to manipulate them by hand with CLI tools like grep, cut, etc and languages like perl and python. I did find a short article that outlines the basic process for setting it up with a google for 'syslog database' at http://ezine.daemonnews.org/200111/syslog.html

syslog-ng supports 'odd' output filters like pipes and programs, but you would have to write something to listen on the pipe or be the program that receives the data and pushes it into the database. Actually would probably be really easy, but I doubt the performance would be very good unless you did some heavy caching in the filter daemon and then you risk the chance of losing log entries in the event of a crash.

msyslog seems to support posgresql and mysql out of the box, again I would do some heavy testing of performance and reliability before putting it into production. That and their site seems down right now...

http://www.frasunek.com/sources/security/sqlsyslogd/ is supposed to be a plugin for a normal syslogd, but it's the same as the program() output driver for syslog-ng and all that overhead for forking a new process for each log message would probably be terrible. I'm also not sure how you're supposed to handle log messages that happen before the network is up, the code is really short and simple so I would assume they would just get dropped by it and you would have to rely on the on disk logs for that.t

 

[cmetz]

FreshPrince, dump all logs into one file and post-process. When doing analysis, causality is important. This also lets you change the post-processing step later and get updated results, if you pp in real time and only record that you can't necessarily reverse/change that step.