1. Centralised logging using RSYSLog
Presented By:
Winston Mphahlele
I.T Department
Vaal University of Technology
28 JUN 2017

2. Outline Logs. Ordinary logs. Centralised logging. RSYSlog.
Client and Central servers.
Loganalyzer.
Question

3. Logs Consists of list of activities performed. A typical history book.
Has a standard format, (W3C).
Can be distinct such as access, error and server logs.
Generally not accessible by normal users.

4. Logs
Access logs
Errors logs

5. Normal logs Each server generates its own logs.
Accessing and managing logs on multiple hosts can be difficult.
No insights of the entire infrastructure.

6. Example Infrastructure

7. What is centralized logging
Consolidation of all your log data and push them to one central location.

8. Centralized logging

9. Why centralized logs? Real time data logs of all sever.
Real time data querying and analytics.
Visualized presentation of data.
A way to parse data and send them to a central database in near real-time.
The capacity of the database to handle near real-time data querying and analytics.
A visual representation of the data through filtered tables, dashboards, and so on.

10. RYSLog System utility providing support for message logging.
Support both local and remote logging.
Fully configurable output format.
Supports multi-threading.
Every logged message contains at least:
IP addres or server hostname.
Date and time stamp.
Program or process name.
Severity.
Message.
Every logged message contains at least:
IP addres or server hostname
Date and time stamp
Program or process name
Severity
Message

11. Using RSYSLog One central log server. Client logs.
MySQL, PostgreSQL, Oracle and more.
Filter any part of syslog message.
Front-end (Loganalyzer).

12. Client and Cental servers
Client server
IP or host to forward logs.
Filter logs.
Central server
Enable imtcp and/or imudp plugin.
Setup a database.
Set up a front-end(Loganalyzer).

13. Loganalyzer

14. Log source

15. Logs

16. Centralized logging with RSYSLog
Centralised troubleshooting.
Centralised Auditing.
Centralised Alerts or alarms.
Trends and patterns by time of day, day of week.
Improved infrastructure insights.
Improved security.

17. Lessons learned Identify critical severs and services.
Start with the most important logs e.g error, access logs .
Filter your logs e.g severity, critical.
Select best protocols suitable, ideally TCP.
Use IP if possible.
Configure front end.
Use configuration management to push.
The target can be specified by DNS name or IP address. Use IP addresses for most robust operations

18. Future?
Graylog2
Elasticsearch Logstash Kibana (ELK).

19. Every failure is a stepping stone to success.
Thank you
Every failure is a stepping stone to success.

20. Questions