Marlys. I also have nearly the exact same box running as "quarterback", syslog-ing for the company's network... I can't say that we have the issue of losing packets due to heavy traffic; I have the problem that some of the machines (Sun hosts) are rebuilt without my knowledge. (They are used exclusively for printing, and the on-site technical support for the printers seems to believe that when something doesn't work, reloading the software and ignoring my list of "specific site configuration rules" is the answer ...) On occasion, it has gone "unnoticed" for a week, before ... In any case, while we have a centralized log server, I maintain some of the logs on the local machines, as well, in the event important logs happen during a compromise, loss of network, etc. This also helps me to spend some time on the local machines, if only to peek and rotate the logs ... I'll be interested to hear what you come up with, attempting to combat this problem. Good luck, gary ----- Original Message ----- From: "Marlys A Nelson" <marlys.a.nelsonat_private> To: <loganalysisat_private> Sent: Saturday, August 11, 2001 4:07 AM Subject: Central syslog server best practices? > For years, I've used the idea of a central syslog host that all our unix > machines use so that the logs were consolidated in one location and less > able to be changed in case of a host compromise. Recently, the log > traffic from our firewall (linux running ipchains) has been so heavy > that the syslog server has been losing data. > > I've thought about multiple servers, a larger central server (though is > this just delaying the problem for awhile again?), logging high volume > servers to local disk (but then how to avoid log compromises if > hacked?), alternative to syslog (I'm just running standard linux > syslog), etc... > > I'm wondering how others configure their syslogging "enterprise-wide" to > avoid this problem? > > -- > Marlys A. Nelson Sr. Network Specialist > Information Technology Services Network Services > University of Wisconsin - River Falls > 410 South Third Street Email: Marlys.A.Nelsonat_private > River Falls WI 54022 http://www.uwrf.edu/ > > --------------------------------------------------------------------- > To unsubscribe, e-mail: loganalysis-unsubscribeat_private > For additional commands, e-mail: loganalysis-helpat_private > > --------------------------------------------------------------------- To unsubscribe, e-mail: loganalysis-unsubscribeat_private For additional commands, e-mail: loganalysis-helpat_private
This archive was generated by hypermail 2b30 : Mon Aug 13 2001 - 14:59:56 PDT