On Wed, Feb 20, 2008 at 11:12:06AM -0800, Kian Mohageri wrote: | Another vote for Tenshi. Probably the best way to do it with | syslog-ng is to have syslog-ng forward logs to Tenshi (listening on | loopback) because otherwise Tenshi won't be able to follow the logs | (if you organize them by date, etc.).
I have syslog-ng keep an additional 'catchall' log that only the tenshi user has access to. It is then rotated every 24 hours via logrotate. This method is no more or less secure, but in my mind it is one less process listening on a socket.
