Handling large amount of syslogs with nagios

[Daniel Wittenberg]

I would think you could eliminate a good portion of those with the right set of dependencies, but outside of that I would personally look at using an MQ to store the messages instead so you can more easily distribute the work and make it more scalable.

Dan

-----Original Message-----
From: Yu Watanabe [mailto:yu.watanabe at jp.fujitsu.com] 
Sent: Thursday, May 17, 2012 5:03 AM
To: nagios-users at lists.sourceforge.net
Subject: [Nagios-users] Handling large amount of syslogs with nagios

Hi all!

I would like to ask for advice for following situation.

In a evironment where 1000 of network devices exists and 
nagios monitoring syslogs using passive checks (+syslog-ng) for every hosts,
 huge amount of notifications occurs when there are problem on
network device side. Syslogs will be sent to nagios as a chain reaction from every
devices although the source is only one device.

To elude this situation,
I am considering an alternate way to monitor syslog and
it would be helpful one can share their thoughts whom had 
faced similar situation and came up with cool idea.

My idea is that combination with file (or FIFO) + check_logs.pl (found this in nagios exchange)
Whenever syslog-ng receives the log, then writes it to file and
nagios actively checks the file with check_logs.pl . 
I thought that in this way it can check the logs in group and 
save number of notifications.

Thank you for reading.

Thanks,
Yu



------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null