I just went through a similar scenario, so I'll offer up the solution I put in place.
All of our syslogs were initially being received by an instance of Kiwi syslog daemon; not stored permanently, just emailed/SMSed on certain events. We suddenly ran into the need to make the messages permanent and searchable by other personnel with varying degrees of access, and needed an immediate solution that required as little reconfiguration as possible. So, I grabbed an underutilized linux server, configured syslog-ng to receive syslogs and inject them into mysql, then threw php-syslog-ng on that server as a web front-end for it all. Then I configured Kiwi to relay anything level notify or above to the linux server..problem solved. Not the most elegant solution, but it was quick and didn't require any reconfiguration of devices or swapping around of servers. Plus, it provided search capabilities by facility/device/time/level/host/message/etc. From there, you're just dealing with making that web page accessible to the third party. If I had to do it from scratch, I'd eliminate the middle-man (Kiwi/Windows) and implement some log rotation so that the database remains optimized. Oh, and if you decide to use the php-syslog-ng, search for the "enhanced" version that's more current (the one by the original name stopped being updated years ago). Hope that helps -- Gregori -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dale Shaw Sent: Thursday, August 16, 2007 12:32 AM To: [email protected] Subject: [c-nsp] Providing 3rd party access to logs (syslog) Hi all, This may be a bit off topic, but I figure the cisco-nsp brains trust will have "been there, done that" already. Has anyone had a requirement to provide 3rd parties with access to log files? I have a requirement to provide access to firewall log files (syslogged) to a security group within an enterprise. Logs held on the logging server will be sorted into a directory hierarchy based on the logging device's name, year, date, day and then severity (or something similar). They will likely be compressed. I figure this could be as simple as setting up a web server on the log server and enabling directory listings / browsing on the virtual directories. Has anyone come across a "nicer" solution? Perhaps something that provides (for example) search capabilities and results filtering, and real time log watching (ala "tail") through a web interface? The log server OS has not been decided yet. It's likely to be Linux or Windows Server. cheers, Dale _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
