Cisco Syslog for Red Hat Linux like Kiwi Syslog

[mmcgurty]

We currently use Kiwi Syslog to catch our syslog messages from our vast amount of Cisco devices. Kiwi is nice because you can set it up to notify on certain parameters like over 2500 messages in one hour, send a notification e-mail or text message about this condition. The best piece is at 24 hours, it compiles a list (nicely formatted and everything) show the top talkers of the last 24 hours. This really helps find the ports or hardware out in the field having issues, proactive maintenance is key. In any case, is there any software that is free out there to do this on Red Hat Linux 9.0?

 

[Serbtastic]

Red Hat comes with syslogd built-in. Just configure the /etc/syslogd.conf file to accept messages from remote hosts.

 

[mmcgurty]

Yes, but can the syslog Red Hat comes with do the e-mail notifications of the top talkers over 24 hrs. and notifications if the logging for a certain device exceeds say 2500 messages in an hour? We actually do have the syslogd running and collecting, but we are looking for something that generates the reports/e-mails that Kiwi creates on the Windows platform.

 

[Bluecrack]

Syslog can do alot of things but it's not nearly as nice as Kiwi for this purpose. I was using Kiwi for a long time and then needed to move to a better machine running Linux. My solution was to log the stuff via syslog to different files and then create web-based perl scripts to generate information from the log files. It works but I'd love to use something like Kiwi on Linux.

 

[mmcgurty]

Bluecrack,

I was afraid I'd get that answer. I did immense amounts of searches on the internet and was unable to find a script or additional program that specifically addresses this kind of need. I would be interested to see those perl scripts if you are able/allowed. I don't want you giving up something proprietary or copyrighted, but it would sure help me out if it something you are allowed to share.

Thanks

 

[Serbtastic]

Actually, I'd be interested too, as right now, I have a web page that displays the entire log, and I look through it manually.

 

[Bluecrack]

That's basically what mine does but with some filtering specific for us. If I ever get some free time, I would like to update the script to count the number of messages from each device per day, break down the number of alerts, errors, informational, etc and perhaps chart it all. I've also thought about passing the logs through swatch to alert me on stuff. Once again, it's a question of time.

I've also toyed with moving much of my network management to something like JFFNMS

http://jffnms.sourceforge.net/.

Bluecrack

 

[lgarner]

I haven't gotten around to writing any reports, but I use msyslogd on the loghost and put everything into a database. Then a web page can search for entries.

http://www.linuxsecurity.com/feature_stories/feature_story-138.html

got me going on it.