Would like to know what the current best practice is for Syslog
monitoring for Unix.  Some tools i've seen suggested are: Swatch,
LogSentry, LogTool, Analog, Nagios.

I'm intertested in something that does active Syslog monitioring and
can generate Sys Admin email alerts when nasty things might be
happening.

[ Post a follow-up to this message ]

On 18 Mar 2004 06:09:51 -0800, Trent Rivers <matahnuva@yahoo.com> wrote:
> Would like to know what the current best practice is for Syslog
> monitoring for Unix.  Some tools i've seen suggested are: Swatch,
> LogSentry, LogTool, Analog, Nagios.
>
> I'm intertested in something that does active Syslog monitioring and
> can generate Sys Admin email alerts when nasty things might be
> happening.

BigBrother (bb4.com) also does this out of the box - configurable
however you want, but by default sends one messages for events that
you'd want to see in a logfile.  Free for most users, easy to set up,
doesn't suck.  We're using it in conjunction with Nagios.

I'm not sure how you'd use Analog for syslog monitoring, unless this
is some add-on I haven't seen; we use that for webserver logfiles
where it performs admirably, but it's a reporting tool, not a monitoring
and notification tool far as I know.  BB will be up and running for you
in half a day if you have a reasonably coherent system to start with.

Dave Hinz

[ Post a follow-up to this message ]

Ok, thanks for the suggestion... i'll check it out

Dave Hinz <davehinz@spamcop.net> wrote in message news:<c3di7n$26p6hs$6@ID-134476.news.uni-
berlin.de>...
> On 18 Mar 2004 06:09:51 -0800, Trent Rivers <matahnuva@yahoo.com> wrote: 
>
> BigBrother (bb4.com) also does this out of the box - configurable
> however you want, but by default sends one messages for events that
> you'd want to see in a logfile.  Free for most users, easy to set up,
> doesn't suck.  We're using it in conjunction with Nagios.
>
> I'm not sure how you'd use Analog for syslog monitoring, unless this
> is some add-on I haven't seen; we use that for webserver logfiles
> where it performs admirably, but it's a reporting tool, not a monitoring
> and notification tool far as I know.  BB will be up and running for you
> in half a day if you have a reasonably coherent system to start with.
>
> Dave Hinz

[ Post a follow-up to this message ]

Trent Rivers wrote:

> Would like to know what the current best practice is for Syslog
> monitoring for Unix.  Some tools i've seen suggested are: Swatch,
> LogSentry, LogTool, Analog, Nagios.
>
> I'm intertested in something that does active Syslog monitioring and
> can generate Sys Admin email alerts when nasty things might be
> happening.

You might be interested in System Event Correllator (SEC) and in
syslog-ng.  syslog-ng can provide active alerts based on content of the
logs.  SEC also does this, but also handles event correlation: it
recognizes when events happen multiple times over a period of time, or
when an event starts to happen "too often", and other similar time-based
checks.  SEC is quite powerful.

Nagios is more of a system monitoring system, though you could have an
alert based on log entries.  I also like SGI's Performance CoPilot (PCP)
for monitoring purposes.

[ Post a follow-up to this message ]

Hello,
[vbcol=seagreen] 

Take a look at Kiwi Syslog they have email and SMS alert add-on options.
http://www.notepage.net/kiwi-syslog/kiwi-syslog.htm

Kyle

[ Post a follow-up to this message ]