topic Re: Reqd to implement a centralised log Server in Operating System - HP-UX

Reqd to implement a centralised log Server

Anand V — Tue, 07 Aug 2007 09:15:34 GMT

Dear Admins,

Is there any way to maintain a centralised log server in which , i need to take a log files for all the servers in a single one server.

I need to maintains and checks the server from
one server and get other servers info's

Thanks In Advance.

Regards,

Anand

Re: Reqd to implement a centralised log Server

A. Clay Stephenson — Tue, 07 Aug 2007 09:35:39 GMT

This is one of those "it depends" questions. It depends upon what you mean by "log files". If you mean those that use the syslog facility then yes, it is possible but otherwise it depends upon how a given application does its logging.

For those that use the syslog facility (which includes the OS and many well-written applications) then you make modifications something like this to your local /etc/syslog.conf file.

Original Entry: (writes to local file)
*.info;mail.none /var/adm/syslog/syslog.log
New Entry: (logs to syslogd on remote host)
*.info;mail.none @mickey.mouse.com

You could actually have both entries operational or you could comment out the original. Man syslogd for details.

For applications which simply write to files for logging, one approach would be to NFS mount those directories so that the logging would be done on a remote host.

Re: Reqd to implement a centralised log Server

Anand V — Tue, 07 Aug 2007 10:07:19 GMT

Dear Mr claey ,

The recquired log file to be centralized is for syslog.log file.

Thanks for your great help.

If possible , give me the syntax and file details which i need to edit whereas i maintain for forty servers of HP 9000 series and two rp series.

Thanks & Regards,

Anand

Re: Reqd to implement a centralised log Server

A. Clay Stephenson — Tue, 07 Aug 2007 12:08:43 GMT

I'm not sure what else you want to know. Since you are talking about syslog logging then it's quite simple.

On each client host, vi /etc/syslog.conf.
For every facility that you want logged remotely replace the local filename with @hostnameofremotesyslogserver.

Old entry:
*.info;mail.none /var/adm/syslog/syslog.log
New Entry: (logs to syslogd on remote host)
*.info;mail.none @mickey.mouse.com

If you changed the old entry to the new then
what once went to the local file /var/adm/syslog/syslog.log will now be sent to a remote syslog server mickey.mounse.com. If you make a copy of the old entry and change the copy to the new entry so that BOTH are in the local /etc/syslog.conf file then logging will be sent to both the local file AND to the remote host.

After making the change, you must tell the local syslogd daemon that you have made the change. Syslogd re-reads its configuration when it receives a SIGHUP (hangup signal; signal 1) so:

kill -1 $(cat /var/run/syslog.pid)

or simply stop and restart the local syslogd.

Now just what part of "man syslogd for details" did you not understand?

Re: Reqd to implement a centralised log Server

Court Campbell — Tue, 07 Aug 2007 12:22:23 GMT

my suggestion would be to setup a linux server as the syslog server. then install syslog-ng. it is more configurable, so you could create filters to log to files based on certain criteria. Depending on your requirements you may need two syslog servers so that you have some sort of redundancy if one of the syslog servers fail.

another option, that i currently use, is a perl script that does log rotation. i then have a cronjob that copies the logs from each server to a management server.

Re: Reqd to implement a centralised log Server

whiteknight — Tue, 07 Aug 2007 21:09:11 GMT

You can consider HP System Insight Manager
to centrally managed your servers.

http://h18013.www1.hp.com/products/servers/management/hpsim/benefits.html

Hope this help

Re: Reqd to implement a centralised log Server

Anand V — Wed, 08 Aug 2007 03:24:58 GMT

Dear Mr Clay ,

My your tips , i finished the task , now i could able to see the logs in pariticular server.

Thanks for you and all other admins also

for their valuable suggesstion.

Thanks & regards,

anand

Re: Reqd to implement a centralised log Server

Anand V — Wed, 08 Aug 2007 03:45:46 GMT

Thanks for HP - Online support Team