On Wed, 2009-12-23 at 19:30 -0500, Nicholas Tang wrote:
> My recommendation: don't log it locally.

Ditto, ship your logs to a dedicated logging/archive server.  All
versions of syslog support this (although syslog-ng and the like offer
better options than syslog's udp logging).

> You could probably also log to Syslog and have it write those logs to
> a remote Syslog server rather than writing them locally.  That won't
> require a network-aware logging module.
> Both of those solutions have the added advantage of allowing you to
> log multiple webservers' logs to a single physical machine and log,
> making it easier to analyze them later.

Yep.  Also you can log to a database, which makes analysis much easier,
and can be done remotely via a read-only (GRANT SELECT...) connections.
Makes people modifying your logs after the fact much more difficult.


-- 
OpenGroupware developer: [email protected]
<http://whitemiceconsulting.blogspot.com/>
OpenGroupare & Cyrus IMAPd documenation @
<http://docs.opengroupware.org/Members/whitemice/wmogag/file_view>

_______________________________________________
Tech mailing list
[email protected]
http://lopsa.org/cgi-bin/mailman/listinfo/tech
This list provided by the League of Professional System Administrators
 http://lopsa.org/

Reply via email to