For this article, I’ll be focusing on syslog-ng as this is more up to date, and if the reader wishes, can be ‘supported’ via the company that owns the syslog-ng software by going with their enterprise edition version at a later date.
via Creating a Centralized Syslog Server | Linux Journal.
This is a good tutorial to get going with syslog-ng. Monitoring events being logged into syslog can provide ample warning when a server is about to die.
20 Linux Log Files that are Located under /var/log Directory.
/var/log/audit/ – Contains logs information stored by the Linux audit daemon (auditd).
But Rainer Gerhards, the lead developer for the rsyslog tool, has now had a chance to analyze Poettering’s and Sievers’ paper in detail and says that the similarities to the Windows Event Log is actually a good thing, since there are aspects of the Windows Event Log tool that would actually be useful in.
But, Gerhards argues, such a drastic change in the way Linux handles system event logging may not be necessary, given that Gerhards’ rsyslog tool, as well as functionality in the competing syslog-ng tool, already can address many of the problems Sievers and Poettering have addressed.
via Red Hat’s Linux changes: Fixes or ISV positioning? | ITworld.
Iptables is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also contain user defined chains.
By default, Iptables log message to a /var/log/messages file. However you can change this location. I will show you how to create a new logfile called /var/log/iptables.log. Changing or using a new file allows you to create better statistics and/or allows you to analyze the attacks