[TriLUG] rotate logs to another device? WAS: Re: centralized logging
rkelleyrtp at gmail.com
Tue Jan 19 17:23:05 EST 2010
Can you map the SAN share as a LUN and rsync your files?
Sent from my iPhone
On Jan 19, 2010, at 15:27, Josh Johnson <josh_johnson at unc.edu> wrote:
> I've gone ahead with syslog-ng and I really like it.
> I have a ton of space on a SAN. What I'd like to do is have excess
> logs get moved over to the SAN on a regular basis. Im going to dig
> into the syslog-ng docs and see if it can handle this sort of mirror/
> split-brain setup, but this seems like a common enough use case (at
> least, I think so!), so I'd like to hear what other people are doing.
> logrotate won't rotate to another device. Does anyone have any
> pointers or suggestions to putting together a cron job or something
> to do handle this?
> I like having the logs handy for quick debugging/checking, but then
> have a relatively large store for historical logs that will get
> crunched from time to time. I also don't want logging to fail if the
> SAN has gone down (or I'd just put all the logs directly on the SAN).
> On Jan 13, 2010, at 10:00 AM, Clay Stuckey wrote:
>> I used syslog-ng before with great results. It had lots of features
>> such as logging to a db as well as log relaying with spoofed source.
>> Clay Stuckey
>> (919) 600-0486
>> claystuckey at gmail.com
>> On Jan 13, 2010, at 9:22 AM, Josh Johnson <josh_johnson at unc.edu>
>>> I want to collect various server logs into a centralized place.
>>> What's the best way to do this? What should I keep in mind when
>>> migrating to a centralized logging infrastructure?
>>> I've been looking at syslog-ng and rsyslogd. I've got a
>>> combination of RHEL 5 and Ubuntu machines.
>>> The primary reason why I need this is because I've got SAN
>>> hardware that will send syslog messages over the SAN network when
>>> drives are getting close to failure or have failed (the docs say I
>>> can get a fairly early warning).
>>> I'm also going to deploy some web applications that generate lots
>>> of logs and will need to be periodically checked to extract usage
>>> statistics and diagnose usability issues.
>>> TriLUG mailing list : http://www.trilug.org/mailman/listinfo/trilug
>>> TriLUG FAQ : http://www.trilug.org/wiki/Frequently_Asked_Questions
>> TriLUG mailing list : http://www.trilug.org/mailman/listinfo/trilug
>> TriLUG FAQ : http://www.trilug.org/wiki/Frequently_Asked_Questions
> TriLUG mailing list : http://www.trilug.org/mailman/listinfo/trilug
> TriLUG FAQ : http://www.trilug.org/wiki/Frequently_Asked_Questions
More information about the TriLUG