logging infrastructure and notes

[Seth Vidal]

On Thu, 14 Jan 2010, Mike McGrath wrote:

> Now that we control reverse lookups this should be easy.
>
>> 2. we need to make sure we cleanup old logs from the above, too.
>>
>
> I asked smooge to look into this this morening :)
>
>> 3. the structure of the log dir doesn't seem to match what we'd normally
>> see in /var/log on any host. They are being logged as a different dir per
>> day, which is great, but it'd be good if rsyslog was putting in the same
>> file structure as a normal set of logs so normal log analysis tools will
>> work on it
>>
>
> Where would /var/log/messages on bastion from 2009-03-01 exist?

Where? On log1? /var/log/hosts/bastion02/2009/03/01/messages

what I'm proposing is that in any given day the dir structure look the 
same as what we would normally find in /var/log on any given machine.


>> 5. Grouping the logs by type of service would also help look at
>> group/service trending and issues. especially if an issue is only popping
>> up on one box.
>>
>
> We can probably do this with symlinks

Not really - you'd want one merged /var/log structure for all of the app 
servers, for example.

-sv