Centralized logging for multiple servers

[Igor Sysoev]

On Mon, Apr 13, 2009 at 12:56:29PM +0930, Kingsley Foreman wrote:

> Hi guys,
> 
> Just wondering what you guys are using for centralized logging of access 
> logs for multiple servers. I'm thinking about using the syslog patch but I 
> was wondering if anyone was using anything they think is better? And has 
> piping of log files been implemented in the newer versions?

I personally do not like syslog and log piping.

I prefer to writing to local file system and to scp logs at midnight to
central host.

Some time ago I needed to deliver logs for hourly statistics. I have made
script that rotates log every hour, then gzips it (it takes several
seconds as a whole ~1G hourly log file is in VFS cache), and sends
the log to host. A daily log is done as

zcat hourly-logs.gz | 7z > daily-log.7z

and then it is copied to central host.


-- 
Igor Sysoev
http://sysoev.ru/en/