Be prepared to many syslog-ng fans answering to you. I haven't tried it myself, but it seems it can also log to SQL. Experts will tell you.
Myself I've been proceeding as follows: 1) added "-r" argument to SYSLOGDARGS in /etc/sysconfig/sysklogd 2) modified /etc/syslog.conf to write down external logs to different files (I have 3 kinds of logs, and every device tag the log w/ a different "facility") E.g. ... # remove local2,local3,local4 from std logging; it is handled elsewhere *.info;mail.none;authpriv.none;auth.none;daemon.none;local6.none;local5. none;local4.none;local2.none;cron.none /var/log/messages ... # routers use local2 local2.* /var/logs/devicelogs/ciscorouter.log # switches use local3 local3.* /var/logs/devicelogs/ciscoswitch.log # pix use local4 (openldap is not used on server side) local4.* /var/logs/devicelogs/ciscopix.log ... Remember that your firewall should tag w/ an appropiate facility to get catched correctly. 3) setup a proper logrotate. Look for /etc/logrotate.d for good samples. What I use is VERY bad written (by me). This is the most important step. I get 60 MB/day of logs and I would finish up w/ a full disk, if I would not make logrotate. Furthermore, logrotate compress older files, if configured so. For viewing, I can't suggest you, sorry. My monitoring system (nmis - www.sins.com.au/nmis) includes a log viewer, and I use it. Ivan > Date: Wed, 26 Oct 2005 16:04:06 +0200 (CEST) > From: Christopher Thorjussen <[EMAIL PROTECTED]> > Subject: Need input on using TSL as logserver > To: <[email protected]> > Message-ID: <[EMAIL PROTECTED]> > Content-Type: text/plain; charset="iso-8859-1" > > I need to set up a (sys)logserver for at least one firewall > and probably some other servers too later on (logfiles from > diskless firewall being the primary objective), and I thought > I'd ask the list for some input and ideas. > > Right now I've got a server installed with a TSL 2.2 > (minimal, commonly used local/network packagegroup installed). > > Should I just (try to) configure syslog or is there better > solutions available? It would be great if I could have a easy > way to view the log files, like through a webserver or > another gui app ('I' as in a few less 'tech' people at work) > > /Christopher > _______________________________________________ tsl-discuss mailing list [email protected] http://lists.trustix.org/mailman/listinfo/tsl-discuss
