Ubuntu Wiki

• Launchpad Entry: server-o-syslog-information

• Created:2011-05-19

• Contributors: ChuckShort

• Packages affected: rsyslog, puppet, octopussy

Summary

Release Note

When deploying a large number of servers using orchestra. Orchestra can configure your servers to point to a central logging server.

Rationale

Large deployments of Ubuntu Server should require a central logging server so that systems administrators dont have to login to a particular machine to check their syslog. We should also provide tools to manage notifications better than we currently have.

User stories

* Peter is a systems administrator who just deployed 100 Ubuntu Servers and wants to setup a central

• syslog server to keep his log files in one place. Peter wants a quick and easy way of deploying syslog to his servers.

* Charles is a system administrator who wants an already packaged tool to analyze and notify of changes

• in his log files.

Assumptions

Implementation

puppet

In order for this to work we need to write two puppet modules. The first puppet module is for the central syslog server. It only installs the package, the certs, and a custom template. It will be up to the user to custom their syslog setup as they see fit. The second puppet module will setup rsyslog and point it to the central syslog server.

logfile analysis

Tools like logcheck is a pretty basic tool however most devops users are moving to use octopussy. It is not packaged in debian but upstream has not filed an ITP. We will do this and maintain it for both Debian and Ubuntu.

BoF agenda and discussion

Centralized Log

Implementation Idea
Puppet recipes

Syslog Alternatives
Facebook Scribe

CategorySpec