Centralized Logging with a Web Interface

Gene Liverman — Mon, 23 Aug 2010 05:05:00 +0000

Wouldn’t it be nice if you had a web interface to the logs on your central log server? Well, dream no more because this one is a reality thanks to LogAnalyzer (aka phplogcon). Let's take a look at how to setup both it and its suggested syslog variant, rsyslog, on a central log server. We will approach this from the perspectives of both Gentoo where rsyslog is not the default (nor is anything else) and Ubuntu 10.04 LTS which is already using rsyslog as the defacto logger. It is also worth mentioning that, according to the rsyslog site, Fedora also now defaults to rsyslog.

The Prep:

Before we dive into setting up any of this we need to do a little prep work. If you are going to be looking at these logs in a web browser then it might be good if the time stamps you are seeing reflect the appropriate timezone. For this I shall borrow from the Gentoo Handbook as it is fitting for both distros:

7.a. Timezone
You first need to select your timezone so that your system knows where it is located. Look for your timezone in /usr/share/zoneinfo, then copy it to /etc/localtime. Please avoid the /usr/share/zoneinfo/Etc/GMT* timezones as their names do not indicate the expected zones. For instance, GMT-8 is in fact GMT+8.

Suppose you are in the eastern timezone:

~# cp /usr/share/zoneinfo/EST5EDT /etc/localtime

Time:

If you are going to be compiling all of your logs in one place then it also becomes rather important that everyone involved know the correct time. To achieve this you can use an NTP client.

Ubuntu 10.04 LTS

Using your favorite text editor, create the file /etc/cron.daily/ntpdate and insert the following:

ntpdate ntp.ubuntu.com

Save the file then

~# chmod 755 /etc/cron.daily/ntpdate

Now let's run it to get our time corrected:

~# /etc/cron.daily/ntpdate

Lastly, verify...

~# date
You should see your current time here.

Gentoo

In Gentoo this is taken care of by net-misc/ntp.

Go to Full Article