|
Home > Archive > Unix administration > May 2004 > Unix Syslog monitoring tool / best practice
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
Unix Syslog monitoring tool / best practice
|
|
| Trent Rivers 2004-03-18, 9:45 am |
| Would like to know what the current best practice is for Syslog
monitoring for Unix. Some tools i've seen suggested are: Swatch,
LogSentry, LogTool, Analog, Nagios.
I'm intertested in something that does active Syslog monitioring and
can generate Sys Admin email alerts when nasty things might be
happening.
| |
| Dave Hinz 2004-03-18, 8:36 pm |
| On 18 Mar 2004 06:09:51 -0800, Trent Rivers <matahnuva@yahoo.com> wrote:
> Would like to know what the current best practice is for Syslog
> monitoring for Unix. Some tools i've seen suggested are: Swatch,
> LogSentry, LogTool, Analog, Nagios.
>
> I'm intertested in something that does active Syslog monitioring and
> can generate Sys Admin email alerts when nasty things might be
> happening.
BigBrother (bb4.com) also does this out of the box - configurable
however you want, but by default sends one messages for events that
you'd want to see in a logfile. Free for most users, easy to set up,
doesn't suck. We're using it in conjunction with Nagios.
I'm not sure how you'd use Analog for syslog monitoring, unless this
is some add-on I haven't seen; we use that for webserver logfiles
where it performs admirably, but it's a reporting tool, not a monitoring
and notification tool far as I know. BB will be up and running for you
in half a day if you have a reasonably coherent system to start with.
Dave Hinz
| |
| Trent Rivers 2004-03-21, 9:34 pm |
| Ok, thanks for the suggestion... i'll check it out
Dave Hinz <davehinz@spamcop.net> wrote in message news:<c3di7n$26p6hs$6@ID-134476.news.uni-berlin.de>...
> On 18 Mar 2004 06:09:51 -0800, Trent Rivers <matahnuva@yahoo.com> wrote:
>
> BigBrother (bb4.com) also does this out of the box - configurable
> however you want, but by default sends one messages for events that
> you'd want to see in a logfile. Free for most users, easy to set up,
> doesn't suck. We're using it in conjunction with Nagios.
>
> I'm not sure how you'd use Analog for syslog monitoring, unless this
> is some add-on I haven't seen; we use that for webserver logfiles
> where it performs admirably, but it's a reporting tool, not a monitoring
> and notification tool far as I know. BB will be up and running for you
> in half a day if you have a reasonably coherent system to start with.
>
> Dave Hinz
| |
| David Douthitt 2004-05-10, 5:44 pm |
| Trent Rivers wrote:
> Would like to know what the current best practice is for Syslog
> monitoring for Unix. Some tools i've seen suggested are: Swatch,
> LogSentry, LogTool, Analog, Nagios.
>
> I'm intertested in something that does active Syslog monitioring and
> can generate Sys Admin email alerts when nasty things might be
> happening.
You might be interested in System Event Correllator (SEC) and in
syslog-ng. syslog-ng can provide active alerts based on content of the
logs. SEC also does this, but also handles event correlation: it
recognizes when events happen multiple times over a period of time, or
when an event starts to happen "too often", and other similar time-based
checks. SEC is quite powerful.
Nagios is more of a system monitoring system, though you could have an
alert based on log entries. I also like SGI's Performance CoPilot (PCP)
for monitoring purposes.
| |
|
|
|
|
|