> I personally like to send my logs to the standard local log file and > I also forward them to a remote syslog machine. > > I use this as a backup in case of the syslog machine being down.
Little known feature of syslog: it will send to multiple machines, particularly easy with syslog-ng. Just log to more than one remote machine; if both are down, then you have both a infrastructure design problem and an operations problem. Having local logs and rotating them independently works OK for discrete machines. In a shared environment or one with lots of diskless workstations, you have to be really careful to stagger the log rotations, or you get enormous bursts of network and CPU activity as a few hundred systems all wake up at 3 AM and try to prune their logs. This is not a Good Thing. ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
