Re: prelude lml...
Jaime Ventura <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Thanks for your reply. Just bumped on another possible solution. Sometime its better to explain the problem rather then ask for a particular solution..:P I need to archive the logs and use "scan" them with prelude-lml. Since prelude-lml is capable of receiving logs through upd/514 and syslog-ng is capable of sending same logs to 2 destinations (file and udp, for instance) im would try to configure it to send the logs to the files and equally to prelude-lml. I believe this wont create an considerable overhead. But that way I wount have control over which server logs are scanned (some servers logs dont need to be scanned, but creating per server configuration on syslog-ng would be painful). What do you think about it? Can I put prelude-lml to listen to a pipe instead of a file or udp port? Thanks Jaime Matt Kettler wrote: > Jaime Ventura wrote: > >> Hello. >> Im installing a server to collect logs from several machines. >> For that, im using syslog-ng writing to files on directories like >> "/log/$FULLHOST/$YEAR$MONTH/" for archive reasons. >> Im planning to install prelude lml. Is there any way to configure >> prelude to read files on directories name like this? >> > > Not sure if that's possible or not. > > You might consider having a monthly cronjob create symlink for > /log/$FULLHOST/current/ which points to the current $YEAR$MONTH. > > > The fullhost shouldn't be much of a problem, as I assume those don't change much > over time. This way you'd just set prelude-lml for /log/system1/current/messages > /log/system2/current/messages, etc, etc. > > > _______________________________________________ > Prelude-user site list > [email protected] > http://www.prelude-ids.org/mailman/listinfo/prelude-user > > _______________________________________________ Prelude-user site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-user