[TriLUG] rotate logs to another device? WAS: Re: centralized logging

[Josh Johnson]

I've gone ahead with syslog-ng and I really like it.

I have a ton of space on a SAN. What I'd like to do is have excess  
logs get moved over to the SAN on a regular basis. Im going to dig  
into the syslog-ng docs and see if it can handle this sort of mirror/ 
split-brain setup, but this seems like a common enough use case (at  
least, I think so!), so I'd like to hear what other people are doing.

logrotate won't rotate to another device. Does anyone have any  
pointers or suggestions to putting together a cron job or something to  
do handle this?

I like having the logs handy for quick debugging/checking, but then  
have a relatively  large store for historical logs that will get  
crunched from time to time. I also don't want logging to fail if the  
SAN has gone down (or I'd just put all the logs directly on the SAN).

Thanks,
JJ

On Jan 13, 2010, at 10:00 AM, Clay Stuckey wrote:

> I used syslog-ng before with great results. It had lots of features  
> such as logging to a db as well as log relaying with spoofed source.
>
> --
> Clay Stuckey
> (919) 600-0486
> claystuckey at gmail.com
>
> On Jan 13, 2010, at 9:22 AM, Josh Johnson <josh_johnson at unc.edu>  
> wrote:
>
>> I want to collect various server logs into a centralized place.  
>> What's the best way to do this? What should I keep in mind when  
>> migrating to a centralized logging infrastructure?
>>
>> I've been looking at syslog-ng and rsyslogd. I've got a combination  
>> of RHEL 5 and Ubuntu machines.
>>
>> The primary reason why I need this is because I've got SAN hardware  
>> that will send syslog messages over the SAN network when drives are  
>> getting close to failure or have failed (the docs say I can get a  
>> fairly early warning).
>>
>> I'm also going to deploy some web applications that generate lots  
>> of logs and will need to be periodically checked to extract usage  
>> statistics and diagnose usability issues.
>>
>> Thanks,
>> JJ
>> --
>> TriLUG mailing list        : http://www.trilug.org/mailman/listinfo/trilug
>> TriLUG FAQ  : http://www.trilug.org/wiki/Frequently_Asked_Questions
> --
> TriLUG mailing list        : http://www.trilug.org/mailman/listinfo/trilug
> TriLUG FAQ  : http://www.trilug.org/wiki/Frequently_Asked_Questions
>