[TriLUG] To syslog or not syslog

[Aaron S. Joyner]

Master Shake wrote:

>Fellow trilugers,
>Many programs (such as BIND) have the option of logging information
>either by syslog, or by bypassing syslog and writing directly to a
>file. What are the advantages of each approach? As I see it, logging
>through syslog has the following advantages:
>...
>Thats my quick and dirty two cents. What are everyone experiences with
>the issue?
>  
>
You've pretty much covered it.  The real solid advantage to syslog is 
centralized logging.  When you're managing dozens or hundreds of hosts, 
you need to get all that data into a central location, parse it, and do 
heuristics or at least pattern matching against it.  You don't want to 
do that on each host for processing time, and more importantly you don't 
want to get dozens or hundreds of emails, you want to get one email with 
interesting information about all hosts (or at least only a few for each 
category of services you're using).

Aaron S. Joyner