Logs and Logging

The trouble with logs...is that there's so many of them. Wouldn't it be nice if we could actually get to the information we needed. This chapter is devoted to methods and tools around managing logs.

System Log Consolidation and Publishing

I was looking for a way to log events from one of my linux firewall/routers. It has been going down at strange times and I kept having to reboot it in the morning. After a bit of searching, I've settled on the following combination of software and technology to create a viable monitoring solution:

You could also use this in conjunction with another utility, https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys, to consolidate your Microsoft Windows Server logs as well. (I haven't tried that yet, though.)

Set up a basic LAMP server, Linux/Apache/MySQL/PHP.
Install the package syslog-ng. Configure syslog-ng to save all logs in a MySQL database. http://www.balabit.com/products/syslog_ng/
Install and configure php-syslog-ng. http://www.vermeer.org/projects/php-syslog-ng

There is some help available on configuring syslog-ng on the php-syslog-ng site.

You can search through the system log and look for specific events or even look for events from specific servers.