What is syslog and what is it used for?

Introduction

Logging from Wikipedia:

“Logging is the cutting, skidding, on-site processing, and loading of trees or logs onto trucks or skeleton cars.”  /Wikipedia/
No, it’s a different industry. Again:
“In computing, a log file is a file that records either the events which happen while an operating system or other software runs, or the personal messages between different users of a communication software. The act of keeping a log is called logging.” /Wikipedia/

Event logging

Recording events on the specified system for different purposes. E.g. monitorting, debugging, audit etc.

How does it looks like in theory on different layers?

Application: collecting events
Data: the actual log messages
Protocol: forwarding events

The syslog protocol itself is described in the RFC5424.

So, syslog

“Syslog is a standard for computer message logging. It permits separation of the software that generates messages from the system that stores them and the software that reports and analyzes them.” /Wikipedia/

And why is it so interesting?

Because in our world the information is asset which can be realized as value. How?
It have to be collected from everywhere, parsed and represented in the required abstraction level.

Have a look on the open source syslog-ng

Some features:
Central log collection
Pattern DB – key/value pairs
Different input sources – files, programs
Different destinations – db, encrypted network
Filtering options
Processing tools, e.g. rewrite, parse,
JSON output and parser

How to install from source

Download the latest version of syslog-ng OSE:

wget https://github.com/balabit/syslog-ng/archive/master.zip

Download the latest version of the EventLog library:

wget https://github.com/balabit/eventlog/archive/master.zip

The following packages have to be installed to compile syslog-ng:

gcc, flex, bison, glib, libpcre, libnet, libesmtp

Add /usr/local/lib/pkgconfig directory to:

PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH

Uncompress the archives using unzip.
Both eventlog and can be compiled with default options:

./configure
make
make install

Alternatives

rsyslog, svlogd, scribe, spread, splunk

References and useful links

http://en.wikipedia.org/wiki/Logging
http://en.wikipedia.org/wiki/Logfile
http://en.wikipedia.org/wiki/Syslog
http://tools.ietf.org/html/rfc5424
http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/ch01s01.html
http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/compiling-syslog-ng.html

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s