[logs] Re: Central Log Server

Previous message: Nick Starai: "[logs] Central syslog server"
Next in thread: Jason Royes: "Re: [logs] Re: Central Log Server"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

jasonat_private

Nick Starai wrote:

> I'm working on setting up a central log server. I've lurked around the

> links at http://www.counterpane.com/log-analysis.html#infrastructure
> several times and setup central logging using 'The Logging Project'.
It
> was fairly simple to setup, but it seemed to be dropping or throttling

> some messages. I would tail both log files and see not all of the
original
> making it over. Was not to pleased with it. I see there are several
> simple ways as doing *.*        @hostname using syslogd, but i want to
do
> all my web logs too. There are several central links, but I was just
> wondering on opinions from the list users of what works best for them.
The
> servers are linux/freebsd. Thanks!
>
> Nick Starai
> Network Administrator
> ItsYourDomain.com
> 1005 W. Wise Road
> Schaumburg, IL  60193
> http://www.itsyourdomain.com
>
> _______________________________________________
> LogAnalysis mailing list
> LogAnalysisat_private
> https://lists.shmoo.com/mailman/listinfo/loganalysis

Nick,

Stale (in tlp 0.8) does not work correctly on FreeBSD because it does
not call clearerr on the monitored file pointer after bleeding data.
I'm guessing you were monitoring a FreeBSD box, saw messages transferred
initially but did not see anything after the initial transferr.
Stale works fine on Linux and Solaris. This issue will be resolved in
0.9.
You can manually patch it quite easily be adding the following in the
bf() function and re-compiling:

if (br) {
    clearerr(f);
    fflush(stdout);
}

Hope this helps.

Jason Royes

_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
https://lists.shmoo.com/mailman/listinfo/loganalysis