Maintaining Logs in Large Enterprises

Any large enterprise will have a diverse mix of network end-points. In addition to Linux servers, there will also be various brands of switches and routers, firewalls, Windows servers, Windows or Linux workstations, network-connected printers, and various forms of network-attached storage devices. Most of these devices generate system logs, and administrators need a convenient way to review logs for the gear that they administer. Sadly, using only the logging systems that come with these devices is anything but convenient for a large enterprise.

Collecting log files from such a diverse collection of end-points isn’t the real challenge. The real challenge is twofold:

• To transform the log files from the various end-points, which all have their own unique log file formats, into a common format that can be read and parsed by a centralized logging program.
• To parse and display log data in a way that allows administrators...