Is log management really useful??

[Gaauge]

Hey guys i have a bit of an unusual question. I use Zenoss to manage my server event logs which is windows based. It has worked well for me till now so i am thinking about adding it to my Linux servers as well. I have a question as to whether it is really useful?? I am yet to proceed to do it so i need to know in advance before whether it is worthwhile. I am talking from an admins point of view here, whether it is really useful in the long term. The admins only look at it should something go wrong or if something goes wrong. Nobody actively monitors the log anyways. Please mention any useful tips/hints if you think it is not necessary to keep logs.

[Devasis]

Well you have made an odd statement indeed. There is not much difference between logs generated on windows and Linux if you look at it in the collective and broader sense of practical usage. Being an admin i myself don't have the time to monitor the logs but it is something on my to do list. but maintaining and updating the existing system is much more of a bigger priority then keeping and monitoring the log in my opinion or rather in my case.

[MrChris-]

I use logwatch on most of my systems with the detail set to 10. It is very much troublesome but it is forwarded towards my mail in box so it's alright for me. One more important issue with respect to log management is rotating the logs, which according to me is required too. I use logrotate which is a very useful application for compressing,mailing,rotation of log files. But keeping an eye on logs is way tedious as an admin once you go past 1 server so it is better to centralize your system log to a fast independent server.

[Calvin K]

I Use Nagios for all your important services and systems. It is not exactly log management but keeps an eagle eye on your servers. I Use logcheck and logwatch for critical servers. I have not centralized my systems logs to an individual server yet but that seems like a good idea as well. The thing is once you grow big beyond one server, an admin can't be expected to keep an eye on all the logs. You would rather let the automated tools do the work for you in those cases. Logs are useless till you encounter a problem with your servers/systems.

[Lillebror]

Useful stuff like disk space usage should have alerts instead of keeping logs which is basically not that helpful as and when a problem occurs. As an admin i rarely get time to monitor all the logs as i don't have a centralized log system as of yet. The posts above me hit the nail right on the head when they say that log management is rather irrelevant or becomes so once you handle more than one server. Nagios is a good tool by the way which helps one keep tabs on what is happening on your system.

[jesse]

Most of the system log daemons nowadays accept logs from remote hosts. These include all the modern distributions which come with support for this very reason. Most of the times there is a configuration file option enabling remote logging. You can usually enable this by starting the daemon with a -r switch which is sufficient. You can configure the remote hosts to log to the remote system log server. We can use a combination of stunnel, mysql to provide for a secure transfer of system log data over a SSL connection to the system log server which can then store the data over a mysql database. You can then message the data into reports etc according to your wish. This is the system followed by my company. Hope this helps,good luck.