Syslog server

July 30, 2008 6:47 AM

SyslogFilter: Any suggestions for a FREE centralized syslog server? The centralized server will most likely be running Centos. What programs do you suggest? I have both window and linux machines that will be sending their syslogs and i will need to do some sort of reporting. Thanks in advance.
posted by flipmiester99 to computers & internet (7 comments total)

The syslogd program that comes with any Linux distribution is able to receive messages over the network, so it's not entirely clear what you're looking for here when you say "syslog server". That said, to collect and report on syslog messages you'll probably want to replace syslogd with something like rsyslog, which can log directly to MySQL, PostgreSQL, or other databases.
posted by pocams at 7:58 AM on July 30, 2008

Let me clarify....I will be running Centos, and im not sure if i should use syslog-ng or rsyslog. That being said i was basically wondering what others are using and/or recommend. I should have worded my question better. All of my other boxes/devices on the network will be forwarding their syslogs to this server. Also have heard about Snare server but dont know much about it.
posted by flipmiester99 at 8:21 AM on July 30, 2008

I'm a fan of syslog-ng and then splunk and the log grep.
posted by iamabot at 8:45 AM on July 30, 2008

splunk AS the log grep.
posted by iamabot at 8:48 AM on July 30, 2008

i'm loving syslog-ng.
posted by rmd1023 at 10:01 AM on July 30, 2008

Splunk is not always free, though. The poster should ensure that the level of syslog traffic is below the limits of the free version if they decide to use it. Beyond that, "some sort of reporting" is a little too vague for me to respond.
posted by rhizome at 10:25 AM on July 30, 2008

Syslog is a simple protocol. I built my own listener in Java that dumps directly to a SQL server in a few hours. It works great, and I have my own reporting engine/triggered email reports for critical incidents.
posted by SirStan at 9:02 PM on July 30, 2008