Sidai team: Analysing log files
Why
Why fret over analysing log files? I suppose the typical answer would mumble something about `security', and `intrusion detection', and the like.The answer I've liked best was one by Hal Snyder (formatting mine):
To: loganalysis@securityfocus.com
Date: 11 Sep 2001 04:04:28 -0500
Message-ID: <87r8tep083.fsf@gamera.vail>
Look at logs as part of monitoring.
If your network has 25 computers or more, and you can't find at least one misconfiguration per week by looking through the logs, then you should change jobs now to something less challenging. :)
Networks drift out of true more often than they halt completely. The longer you leave any network resource unattended, the more glitches it will accumulate. The most ``interesting'' (costly) system failures have four or five things wrong, no one of which would have been a show-stopper.
Monitoring software will watch for problems you know to expect. For everything else, you need to scan the logs.
Show the biz types the time-vs-probability-of-failure curve if you don't keep an eye on things.
With what
Tina Bird's list of tools on LogAnalysis.Org is very good.Also: Linux.org has a whole section on log analyzers.