Here at CIAS we have a bunch of linux servers, and we run logwatch on them to give us a daily look at our servers.

There are few options with logwatch and how you want to get the information, you can have it email you, which for one or two servers that is pretty standard, but we are managing 10+ servers, and i don’t want to clog up my email and i don’t want to use my inbox as a way to archive all of our logwatch reports.

So what did I come up with?

On The Server

Everything that happens here is using a simple upload script i created to facilitate the aggregation of the scripts. Machine’s logwatch runs as a cron scripts and outputs its report to a directory on the machine. Right after that script runs another scripts run and copies the logwatch report to a central web server.

On the Web Server

The ‘logwatch’ app is just a nice simple front end to a bunch of directories from this structure

archive
    server1
        12-3-07
            logwatch.txt
        12-2-07
            logwatch.txt
     server2
            12-3-07
                logwatch.txt

I created a nifty little PHP class that takes care of this structure, and allows easy access to the files through code.

RSS and <insert favorite news reader here>

Cool, so now i have a nifty little web app that organizes our logwatch reports… so whats the next step?

I already run NetNewsWire on my Mac and RSS would be a perfect solution for seeing updated logwatch reports as they come in from the servers. So create the RSS is was pretty easy…

1. use the PHP class
2. output in RSS format the last 5 logwatch reports for the specified server
3. RSS MONEY!!

I’m pretty happy with this elegant solution. I always have a hard time remembering to ‘go’ to a web app… I always keep NetNewsWire open. So this solution makes me a better System Administrator

Leave a Reply