How do I setup a syslog server for my network?

You should start with the idea of a centralized log server (which should be a server, not your desktop machine). The simple way to do this is to set up the syslog that already exists on all your machines to ship logs to a central host. That central host then puts all the log messages into one file or a small collection of files.

Here's a central loghost mini-howto to get you started. Note that traditional syslog has a number of limitations such as the ability to only send logs over udp and no support for log rotation. Many people use the open source version of syslog-ng to address these issues, although that does come at the price of a more complex configuration.

Once you have all your logs going to a central location, you can use various tools to analyze them. I'm particularly interested in the new open source tool logstash as a way to do this. There are also non-free tools such as Splunk which previous posters have already commented on.

Tags:

Syslog