# Best System Logger & Central Syslog?

## humbletech99

I want to implement a central syslog server but I also want to know what the real difference is at the end of the day between the various system loggers?

This is probably my weakest area so I need come help.

Which is better and why? Can anybody make any recommendations as to what I should use, both for individuals systems and the master syslog server?

----------

## Drunkula

Well I'm using syslog-ng and it works fine for me.  But then again it is only logging for 2 systems (the local box and my pfSense firewall).  The configurations seem fairly flexible.  It's been awhile since I used any of the others so I can't comment there.

----------

## humbletech99

Thanks, what do you do for log rotation?

Why are there different system loggers, syslog, syslog-ng, metalog, what's the point?

----------

## think4urs11

 *humbletech99 wrote:*   

> Thanks, what do you do for log rotation?
> 
> Why are there different system loggers, syslog, syslog-ng, metalog, what's the point?

 

Why are there different editors, nano, vim, emacs, what's the point?   :Wink: 

Syslog-NG is much more tune/configurable than syslog is. metalog can (afaik) only be a local logger.

I've two syslog-ng servers and one old syslog server right now, beeing central logserver for about 380-400 machines. Nearly everything logs to them, from network equipment to unix machines, windows servers and even (with some tricks) as400.

As web frontend we use php-syslog-ng.

----------

## humbletech99

thanks for that, I will apply that.

btw, it's very hard to think 4 ur self when you have an avatar like that distracting poor unprepared forumers like myself!   :Shocked: 

 :Cool: 

----------

## kashani

syslog-ng. It's fancier than plain old syslog and metalog can not take logs from the network. 

Google around, there are a number of good how-to's for central loghosts.

kashani

----------

## humbletech99

looks like syslog-ng it is!

I think metalog is the recommended in the gentoo handbook, apparently cos it's the only one with log rotation built in. I wonder if it can at least send network logs cos a lot of our machines are using it.

what does syslog-ng have over plain old syslog?

Are there any others besides syslog, syslog-ng and metalog? Just curious...

----------

## think4urs11

 *humbletech99 wrote:*   

> btw, it's very hard to think 4 ur self when you have an avatar like that distracting poor unprepared forumers like myself!

 

baaah, shouldn't be an issue, should it? With an (ex)-model as girlfriend you get accustomed to it, believe me.

I even have to to work with a female colleague also playing in or above this 'optical league' - you get used to it working with her *g*

 *humbletech99 wrote:*   

> I think metalog is the recommended in the gentoo handbook, apparently cos it's the only one with log rotation built in.

 

Depends on how you define log-rotation. With NG you can configure to have one logfile per day per machine in a date-based (automatically generated) folderstructure. Only thing missing is the auto-delete for older logs. But thats just one find command...

 *humbletech99 wrote:*   

> what does syslog-ng have over plain old syslog?

 

filters

 *humbletech99 wrote:*   

> Are there any others besides syslog, syslog-ng and metalog? Just curious...

 

new-syslog, sdsc-syslog

----------

## humbletech99

you mention logging to different files/folders for different days which is done via the macros in syslog-ng and is what I have done and it seems to have worked well for nearly 2 months but you also mention using php-syslog-ng which requires a mysql backend. I've been thinking about this and would like some advice:

what is the advantage of using a mysql backend over plain text files. Plain text files are much easier to manipulate and control from a shell, especially for someone like me who doesn't know much in mysql beyond a few basics... although I have found it's not hard and the mysql manual seems to be reasonably good.

see this new thread Central Logging: MySQL backend vs Text Files https://forums.gentoo.org/viewtopic-p-3304982.html#3304982

----------

## think4urs11

I do some sort of dual logging.

a) via plain text files into date based folder structure

b) into a mysql database on the syslog machine with php-syslog-ng as frontend

Actually this gives the best of both worlds.

I can have all sorts of scripts working against the text files (e.g. SEC, logwatch), i can do automated SQL squeries against the database *and* i have an easy-to-use frontend for my admin colleagues (mostly windows guys so they really don't like CLI) to have them doing their manual lookups as needed.

For automatic checks it's sometimes easier to have the logs seperated per machine or (if you need to check for events like hacking attempts across your infrastructure) against the 'global view'. So i can do both with the only issue of needing twice the space to save the logs. Up to know space shouldn't be a problem.

I've done some searching about finding a web frontend to syslog but up to know nothing (as useable as) php-syslog-ng found.

Additionally for the real urgent log messages i've implemented some alarming via smtp mails.

TBD are things like automatic correlation between logs and our change management for example (cross checking implementation dates for changes and things like that)

----------

