Differences

This shows you the differences between two versions of the page.

--- archive_log_host [2009/02/21 13:31] – _bacam
+++ archive_log_host [2026/09/26 19:08] (current) – removed - external edit (Unknown date) 127.0.0.1
@@ Line 1: / Line 1: @@
-Most Tardis Linux machines are set to send log messages to the log host (currently [[piper]]) for easy consultation and to provide log summary emails.  The summary emails are compiled by [[http://www.tardis.ed.ac.uk/~bacam/logprocessing/|bacam's piperlog]] (previously they were produced by [[http://packages.debian.org/logcheck|logcheck]]) and boring messages can be ignored by adding new patterns to the ''local-*'' files in ''/etc/logcheck/ignore.d.server''.  These are sent to the ''sysmans-logs'' alias.  Separate emails are provided for mail by [[http://packages.debian.org/pflogsumm|pflogsumm]], which are sent to ''postfix-logs''.
-To make syslog send logs to the log host, put
-  *.*     @loghost
-into ''/etc/syslog.conf''.
-To get syslog to accept remote logs, you need to edit ''/etc/init.d/sysklogd''.
-Some newer installs have rsyslogd rather than syslog.  This causes problems when sending logs to an external syslog that doesn't handle the hostnames properly (see rsyslogd's README.Debian for details), so instead put
-  $template sysklogd,"<%PRI%>%TIMESTAMP% %syslogtag%%msg%"
-  *.* @loghost;sysklogd
-To receive hourly log summaries by email, add yourself to the sysmans-logs and root aliases in /etc/aliases on [[mccoy]], and remember to run 'newaliases' when you're done. The altlogs alias was introduced when the piperlog script was first tried out, but now receives the same logs as sysmans-logs.
-===== Firewall logging =====
-The one exception to the above is the firewall, which generates its own log emails.  Currently this uses [[http://www.tardis.ed.ac.uk/~bacam/logprocessing/|bacam's piperlog]] for the syslog entries and [[http://packages.debian.org/fwlogwatch|fwlogwatch]] for firewall reports.