
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
406
Chapter 12
CHAPTER 12
System Log
Management and
Monitoring
Whatever else you do to secure a Linux system, it must have comprehensive, accu-
rate, and carefully watched logs. Logs serve several purposes. First, they help to trou-
bleshoot all kinds of system and application problems. Second, they provide valuable
early warning signs of system abuse. Third, after all else fails (whether that means a
system crash or a system compromise), logs can provide us with crucial forensic
data.
This chapter is about making sure your system processes and critical applications log
the events and states you’re interested in and dealing with this data once it’s been
logged. The two logging tools we’ll cover are syslog and the more powerful Syslog-ng
(“syslog new generation”). In the monitoring arena, we’ll discuss Swatch (the Simple
Watcher), a powerful Perl script that monitors logs in real time and takes action on
specified events, plus a few “offline” log-reporting tools.
syslog
syslog is the tried-and-true workhorse of Unix logging utilities. It accepts log data
from the kernel (by way of klogd), from any and all local process, and even from pro-
cesses on remote systems. It’s flexible as well, allowing you to determine what gets
logged and where it gets logged to.
A preconfigured syslog installation ...