Event Log centralization

C

cb9fl

Limp Gawd
Joined
Jan 2, 2006
Messages
456
What do you all use to aggregate server event logs? I'd like to find an open source or free product that will pull event logs from multiple servers into a single searchable database.
 
If your not talking about 100's of servers you can use Microsoft's Log parser. It allows you to run it and export it right into a SQL database. I use it as a scheduled task to export all print jobs from my print servers into a SQL DB.
 
kiwi syslog, MySQL, evtsys by Purdue Uni and a custom web gui i developed (i didn't use any event logs for my demo, but i do at work). It's not the best solution, but at least it works and was all free. Kiwi gave me a free license.
 
If it is only a small number of servers, you can dedicate a Log Server and write a script on it which will copy the files to a fileshare on your network.
 
oakfan52 said:
If your not talking about 100's of servers you can use Microsoft's Log parser. It allows you to run it and export it right into a SQL database. I use it as a scheduled task to export all print jobs from my print servers into a SQL DB.
Click to expand...

is there a practical limit for MS's Log Parser?
I've got about 40 servers that need active log monitoring.
Can the log parser run on a central machine and connect to various machines around the network, or does it have to actually run on each machine?
How do you avoid re-exporting records (duplicates)?
 
to add to the above poster about GFI SELM

They have released a replacement product called Events Manager

Its nice. Im using in in a test environment , monitoring all DC's , exchange , and sql. It will also accept wc3 logs from ISA and syslog' s. Its a nice package
 
mobiux said:
is there a practical limit for MS's Log Parser?
I've got about 40 servers that need active log monitoring.
Can the log parser run on a central machine and connect to various machines around the network, or does it have to actually run on each machine?
How do you avoid re-exporting records (duplicates)?
Click to expand...

yes, I run sceduled taks from one machine that collect against all of my print servers. It uses a checkpointfile to keep track of what was already imported. I use MS SQL because thats what I have avialable, but i'm sure it will work with mySQL if you have that.

I think the only real limitation is the amount of records being put into the DB. MY system logs roll over very 2 days. I have 3 million records for 6 months worth of print jobs (I only export event id 10). So if you have that many records i would think about doing some stored proceedures to archive records to a diff table every few motnhs or so but that up to you. It will just increase your query times when you go to do reports.
 
You must log in or register to reply here.
Back
Top