Re: svlogd / multilog -> SQL database

["Daniel Clark" <dclark@pobox.com>]

On 1/11/07, Charlie Brady <charlieb-supervision@budge.apana.org.au> wrote:
> On Thu, 4 Jan 2007, Daniel Clark wrote:
>
> > Has anyone happened to have done any work to get svlogd/multilog data
> > into a SQL database, such as PostgreSQL?
>
> I think what you mean to say is, has anyone written a logger which can be
> used by supervise/runit in place of svlogd/multilog. It will read from
> standard input, and write log records into an SQL database.
>
> I don't see where or why you'd use svlogd or multilog in that scenario.
>
> [I'd be concerned about reliability and load issues.]

Yes, you are right; looking at this again, it seems like I would want
to use socklog (with svlogd) on the client machines to get the logs to
the central server [1]. So the question is, once this is done, what
runs on the central server to get the information into PostgreSQL?
Based on the rousing response to this thread, I'm guessing the answer
is some script I go and write myself :-)

> Alternatively, you might post-process svlogd log files into SQL (at normal
> log rotation time, and from time to time otherwise), depending on what
> analysis capabilities you are seeking.

Yes, that would probably make the most sense.

[1] http://smarden.org/socklog/network.html

Thanks for the reply,
-- 
Daniel Clark # http://dclark.us # http://opensysadmin.com