Re: Consolidate logwatch message from all servers to 1 server

Sharpe, Sam J wrote:
> I believe what Leuy wants is a single email per day. What you've
> suggested is an email per-server per-day to a single email account.
>
> Logwatch processes log files generated by syslogd. To generate a single
> email, you should set all of your clients to syslog to a central server.
> You then run logwatch only on that central server.
>   
Logwatch does more than syslog though ... it reports on all kinds of 
things.   You could merge all the logwatch messages into a single 
message, but you'd need log watch to do it's information gathering and 
then send the summary to a central place which could wrap it all up so 
you could get a single message.

I know Leuy was asking for a single message, but I don't think it's 
possible with logwatch, but I'm guessing that what's actually needed is 
all the messages in one place so you don't have to log in to each system 
to get the mail message.

I agree that once you get over a handful of systems you need something 
more sophisticated.   Nathan Ruby wrote on the nahant list:
> OTOH, there are also realtime utilities like sec.pl, swatch, logsurfer,
> sawmill, and splunk that can monitor your logstream for these kinds of
> events and alert you immediately.  Most useful when employed against a
> central loghost, yadda, yadda.... :) 
and they're all worth checking out.   Must do something myself one of 
these days.

jch

--
Taroon-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/taroon-list