Hi, I have central log server (syslog) and I want to copy (move) there also logs which are not logged via syslog e.g. apache access logs, squid access logs... (both apache and squid are able to log _error_ logs via syslog, but access logs are of much bigger volume and it's probably not good idea to log them via syslog, it's not supported anyway). I was thinking to use scp or rsync tunneled through ssh. But there are some problems with syncing logrotate and moving data to the log server: I will do logrotate every day (on 'client' machines) and update logs on the logserver every hour e.g. by rsync. When I will rotate logs on 'clients' I have to rotate logs also on log server otherwise rsync will rewrite the log on the log server at next update (next hour) by new file. Then here arises problem of logrotate syncing (possible different times on different machines) - I would like to avoid installing a network time protocols for syncing time. Logrotating every day and uploading every hour was chosen without any testing, so maybe it is inappropriate. But I guess update logs e.g. every day is too slow, giving attacker whole day to clean logs on broken computer before logs will be sent to the log server. Do you have any (better) ideas how to do this? Another question is about ssh transfer. How to automate upload (rsync or scp) without necessity of typing in passphrase - is ssh key without passphrase OK? Then this could work from cron easily. Of course I would create special user for this uploads, with limited rights (e.g. chroot /var/log on the server, no shell, etc). Any ideas are welcome. Thanks in advance, Radek Spacil -- +----------------------------------------------+ | Radek Spacil, research assistant, | | WLan project, Telecommunication laboratory | | Lappeenranta University of Technology | | email: <radek.spacilat_private> | | www: http://www.lut.fi/~spacil/ | | icq: 56361517 jabber: radek.spacilat_private | +----------------------------------------------+ --------------------------------------------------------------------- To unsubscribe, e-mail: loganalysis-unsubscribeat_private For additional commands, e-mail: loganalysis-helpat_private
This archive was generated by hypermail 2b30 : Mon Feb 18 2002 - 11:38:04 PST