Arch Linux

SoleSoul

Member

From: Israel

Registered: 2009-06-29

Posts: 319

Anyone ever used a log analyzer/watcher/web interface before?

Hi all.

I've been given a job from our computer center, as a student, to come up with a solution to centralized logging and log analysis.

I chose CentOS 5.5 as an OS, rsyslog as the syslog daemon, and Adiscon LogAnalyzer as a log viewer though web interface.

I made these choices after quite much time of searching an testing but I'm not really satisfied with LogAnalyzer.
LogAnalyzer is a nice and simple web interface but it has some problems for me. For example, there are no real search operators like "AND" "OR" ">=" and the like.
It also has some problems with searching. When there are very few results sometimes the search seem to get "stuck" somehow until I  cancel the request.
Some real log analysis capabilities could also be a good bonus since afaik LogAnalyzer has none (which is ok).

If you know a tool for log watch/analysis/search please tell me. It would really help me.

Thanks!

(please no lmgtfy answers I searched quite enough)

fukawi2

Ex-Administratorino

From: .vic.au

Registered: 2007-09-28

Posts: 6,237

Website

Re: Anyone ever used a log analyzer/watcher/web interface before?

One of the best "analysis" tools I've found is to have a script that *ignores* certain regex patterns.

You add to the list of regex everything that is 'normal' and you don't care about, then you only see the 'strange' things:
http://git.archserver.org/?p=sysopscrip … 484491b187

---

Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?

BlueHackers // fscanary // resticctl

SoleSoul

Member

From: Israel

Registered: 2009-06-29

Posts: 319

Re: Anyone ever used a log analyzer/watcher/web interface before?

Thank you fukawi2.
I'll take a look at this approach also.

Anyway, if anyone knows a nice gui tool, I would like to hear about it.
Thanks!

brenix

Member

From: California

Registered: 2008-03-05

Posts: 185

Re: Anyone ever used a log analyzer/watcher/web interface before?

If your looking for a fancy web GUI, you could try out Splunk. I've only tried it once, but I prefer simple tables etc..