> I honestly haven't seen any systems actually configured for remote syslog in my time in the industry.
um... We do this on all of our servers. I love being able to tail one single file and get everything going on. Now, we don't do this outside of our local network. But a gig network seems to be able to handle the bandwidth just fine. I'd love a nice tool that would allow us to securely archive log files. And to me it seems that Journal is trying to do both, Archive, and transport. I don't think these two processes should effect each other. We also find that Splunk works pretty for the archiving and searching. As well as getting a hold of log files that don't output to syslog ie. request.log.
Posted Nov 23, 2011 23:36 UTC (Wed) by dlang (✭ supporter ✭, #313)
[Link]
splunk is great for searching logs (I have a large cluster of machines for doing exactly this), but in terms of gathering and transporting logs, it's far from the best.
take a look at syslog-ng and rsyslog and the options they have to gather data from log files written by other apps.
The Journal - a proposed syslog replacement
Posted Nov 25, 2011 15:02 UTC (Fri) by jeremiah (subscriber, #1221)
[Link]
those are on my list. It's mostly an issue of upgrading servers at this point to version that support them.