Managing logs

[Jim Canfield]

Gaddis, Jeremy L. wrote:
> On 1/8/07, John O'Loughlin <j.oloughlin at qmul.ac.uk> wrote:
>> You can have one machine with syslog accepting remote loging --
>> edit /etc/sysconfg/syslog
>> with SYSLOGD_OPTIONS="-r -m 0"
>>
>> these boxes will now send there logs to loghost. you can also then 
>> install
>> swatch on loghost
>
> Agreed.  This is the "best way", IMO.  It's what I use for my
> switches, routers, and tens of Linux-based servers.  With syslog-ng,
> you can even "organize" your logs on that single loghost.
>
This approach seems to be the most logical.  It's centralized and has 
few moving parts.   I appreciate the quick responses. I will start my 
syslog-ng training immediately. : )

Jim