Reqd to implement a centralised log Server

[Anand V]

Dear Admins,

Is there any way to maintain a centralised log server in which , i need to take a log files for all the servers in a single one server.

I need to maintains and checks the server from
one server and get other servers info's

Thanks In Advance.

Regards,

Anand

[A. Clay Stephenson · Accepted solution]

This is one of those "it depends" questions. It depends upon what you mean by "log files". If you mean those that use the syslog facility then yes, it is possible but otherwise it depends upon how a given application does its logging.

For those that use the syslog facility (which includes the OS and many well-written applications) then you make modifications something like this to your local /etc/syslog.conf file.

Original Entry: (writes to local file)
*.info;mail.none /var/adm/syslog/syslog.log
New Entry: (logs to syslogd on remote host)
*.info;mail.none @mickey.mouse.com

You could actually have both entries operational or you could comment out the original. Man syslogd for details.

For applications which simply write to files for logging, one approach would be to NFS mount those directories so that the logging would be done on a remote host.

[Anand V]

Dear Mr claey ,

The recquired log file to be centralized is for syslog.log file.

Thanks for your great help.

If possible , give me the syntax and file details which i need to edit whereas i maintain for forty servers of HP 9000 series and two rp series.

Thanks & Regards,

Anand

[A. Clay Stephenson]

I'm not sure what else you want to know. Since you are talking about syslog logging then it's quite simple.

On each client host, vi /etc/syslog.conf.
For every facility that you want logged remotely replace the local filename with @hostnameofremotesyslogserver.

Old entry:
*.info;mail.none /var/adm/syslog/syslog.log
New Entry: (logs to syslogd on remote host)
*.info;mail.none @mickey.mouse.com

If you changed the old entry to the new then
what once went to the local file /var/adm/syslog/syslog.log will now be sent to a remote syslog server mickey.mounse.com. If you make a copy of the old entry and change the copy to the new entry so that BOTH are in the local /etc/syslog.conf file then logging will be sent to both the local file AND to the remote host.

After making the change, you must tell the local syslogd daemon that you have made the change. Syslogd re-reads its configuration when it receives a SIGHUP (hangup signal; signal 1) so:

kill -1 $(cat /var/run/syslog.pid)

or simply stop and restart the local syslogd.

Now just what part of "man syslogd for details" did you not understand?

[Court Campbell]

my suggestion would be to setup a linux server as the syslog server. then install syslog-ng. it is more configurable, so you could create filters to log to files based on certain criteria. Depending on your requirements you may need two syslog servers so that you have some sort of redundancy if one of the syslog servers fail.

another option, that i currently use, is a perl script that does log rotation. i then have a cronjob that copies the logs from each server to a management server.

[whiteknight]

You can consider HP System Insight Manager
to centrally managed your servers.

http://h18013.www1.hp.com/products/servers/management/hpsim/benefits.html


Hope this help

[Anand V]

Dear Mr Clay ,

My your tips , i finished the task , now i could able to see the logs in pariticular server.

Thanks for you and all other admins also

for their valuable suggesstion.

Thanks & regards,

anand

[Anand V]

Thanks for HP - Online support Team