Centralized linux system log analyzer?! Post: 302566439

Sponsored Content

Special Forums UNIX and Linux Applications Infrastructure Monitoring Centralized linux system log analyzer?! Post 302566439 by jabalv on Thursday 20th of October 2011 11:06:03 AM

10-20-2011

Registered User

Quote:

Originally Posted by Neo

My experience is that zabbix is more flexible than logzilla... and neither is really what I would call 'great' for analysis.

Remember, collecting, aggregating and filtering "events" is not really "analysis"; and neither is simple "event triggering" based on simple pattern matching rules.

When I look at logzilla (as in zabbix), I don't see any analysis capabilities; only aggregation, filtering, and simple rule based pattern matching. This is really not "analysis" in my view.

For example, "analysis" would be a software process that can detect, from Apache2 log files, when an IP address is a "bot" (web spider) without looking at the user agent (UA). This is not easy in the general case and requires some pretty sophisticated analysis over time.

Yeah, I`m using zabbix too. But I can`t get it work well with log files. I only use it for specified process, event, etc.. I wrote bash scripts and then use zabbix trapper. Zabbix is good for system monitoring, but not for log files I think.

jabalv

View Public Profile for jabalv

Find all posts by jabalv

10 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

Centralized syslog server

I have a syslog server running Solaris 5.9 that is used exclusively to receive log messages from several thousand Cisco devices. The syslog server is and has been running fine for several months.. I would like to take all messages logged from the Cisco devices on this server and forward them...

2. UNIX for Dummies Questions & Answers

centralized unix user management

Does it exist centralized tools on unix for managing users of all servers (like windows AD) ?

3. UNIX for Dummies Questions & Answers

how to configure centralized log server

hi, i am beginner i am using small lan setup all machine fc 6 and fc7 8 and fedora 9 also i want to know how to configure centralized log server on fedora 9 step by step any one help me Thanks

4. HP-UX

HP UX Syslog Analyzer

Hi everybody I need to analyze syslog file in HP UX Is there any log analayzer for this file? Regards

5. UNIX for Advanced & Expert Users

Need help on setting up Centralized Server

Hello All, I am working on SuSe Linux Platform. Some times ago i got an issue with an application for which i had to update that in all desktops (SLED == SuSe Linux Desktop). Since this time number of desktops were less then it was possible to go and update package manually. But in...

6. IP Networking

Best iptables log analyzer?

Hello all, i want to view my iptables log on web interface, with chart (in option, and this is not my priority). What is the best program for this? I have Ubuntu server. Thanks ! :)

7. AIX

Accessing files on AIX system from Linux system

I have a following requirement in production system 1 : LINUX User: abcd system 2: AIX (it is hosting a production DB) Requirement user abcd from system 1 should have read access on archive log files created by DB on system 2. The log files are created with permissions 540 by user ora ,...

8. Programming

Linux/Solaris System Administrator to become a Linux/Solaris System Programmer?

Hi all What is the qualification required by Linux/Solaris System Administrator to become a Linux/Solaris System Programmer as to gain complete knowledge on computers. Thanks

9. Shell Programming and Scripting

Log file analyzer, super basic sh file

Hello! I have a small shell project that is due next week, that I'd appreciate some help with. task: Write a shell program that can analyze at least 2 types of log files and print them in an easily readable way. Make it so that you can switch between log file types. The two file types should be...

10. Homework & Coursework Questions

Log file analyzer, super basic sh program

Hello! I'd like some help with this assignment. 1. The problem statement, all variables and given/known data: 1)Write a shell script that can uses two types of files as inputs, apache.log and apache.error.log 2)Make it so that you can switch between the two file types 3)Make it so that the...

LEARN ABOUT DEBIAN

make_combined_log2

make_combined_log.pl(1) 				      General Commands Manual					   make_combined_log.pl(1)

NAME

       make_combined_log.pl - make combined logfile from SQL database

SYNOPSIS

       make_combined_log.pl <days> <virtual host>

DESCRIPTION

       This perl script extracts the httpd access data from a MySQL database and formats it properly for parsing by 3rd-party log analysis tools.

       The  script  is	intended  to  be run out by cron. Its commandline arguments tell it how many days' worth of access records to extract, and
       which virtual_host you are interested in (because many people log several virthosts to one MySQL db.) This permits you  to  run	it  daily,
       weekly, every 9 days -- whatever you decide.

NOTE

       By  "days"  I  mean "chunks of 24 hours prior to the moment this script is run." So if you run it at 4:34 p.m. on the 12th, it will go back
       through 4:34 p.m. on the 11th.

KNOWN ISSUES

       Because GET and POST are not discriminated in the MySQL log, we'll just assume that all requests are  GETs.  This  should  have	negligible
       effect  on  any analysis software. This could be remedied IF you stored the full HTTP request in your database instead of just the URI, but
       that's going to cost you a LOT of space really quickly...

       Because this is somewhat of a quick hack it doesn't do the most robust error checking in the world. Run it by hand to  confirm  your  usage
       before putting it in crontab.

AUTHOR

       Edward Rudd <eddie@omegaware.com>

MAN PAGE CREATED BY

       Michael A. Toth <lirul.lists@gmail.com> - based on comments of script

COMMENTS

       This man page was written using xml2man (1) by the same author.

Manuals 							       User						   make_combined_log.pl(1)