At last week's DC1 telecon I mentioned that we at LBT had implemented a
scheme to aggregate syslog messages from multiple nodes, so that a
central event log could be maintained. Here are some details from Alex
Lovell-Troy, who did the bulk of the work. This infrastructure is
complemented at the application level by some handy C++ classes, which
we could implement in Python if desired.
I will likely miss tomorrow's telecon due to a meeting at UW.
Tim
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Apr 17, 2006, at 5:37 AM, Tim Axelrod wrote:
Hi Alex,
I'm contemplating using a syslog aggregator similar to what I think
you and Saju put together - which as I recall took specified
classes of sylog messages from a set of machines and aggregated
them into a single central syslog file. Is my memory roughly
correct? And, what was involved in implementing it?
On the client side, all machines need to do is add a line that
directs all output that is not authentication related to an external
logserver. On the central logserver, I use a different syslog called
syslog-ng (http://www.balabit.com/products/syslog_ng/). It's
configuration is a little more complex than the standard syslog, but
you can apply filters to combine messages from many machines and/or
exclude messages that you don't care about. I would be happy to help
you with configuration of syslog-ng if you want. There are also ways
of using the filters in syslog-ng to do rudimentary anomaly and
intrusion detection if that is something you are interested in.
- -alex
Alex Lovell-Troy
Principal SSA
Large Binocular Telescope
[EMAIL PROTECTED]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)
iD8DBQFEQ7xAdmWtRNAkjzERAtYyAJ9MssH4FYpAa90GWG3kppeo1y9xMACeLBEy
Oib2v6ZwPJgvCTpJan0agw8=
=YAMm
-----END PGP SIGNATURE-----
--- End Message ---
_______________________________________________
LSST-data mailing list
[email protected]
http://www.lsstmail.org/mailman/listinfo/lsst-data
