Syslog Agents on Windows

In order to send events from a Windows device to a remote syslog server like Log Insight, you need a syslog agent. Windows does not natively support syslog. The good news is that several syslog agents for Windows exist. I would like to cover my considerations and recommendations for a syslog agent on Windows.

UPDATE: As of Log Insight 2.0, Log Insight offers a free Windows agent that supports the syslog protocol and Log Insight’s ingestion API. For more information see these┬áposts.


Continue reading

Syslog Agents on Linux

In order to send events from a Linux device to a remote syslog server like Log Insight, you need a syslog agent. Most Linux operating systems ship with a syslog agent and if one is not available, one can be easily installed. The two most common syslog agents used on Linux systems today are rsyslog and syslog-ng. I would like to cover how to configure these syslog agents to send events to a remote syslog server.

Continue reading

Logrotate Limitations Revisited

The more I use logrotate the less I like it. If you recall from my previous post on logrotate, I choose to leverage the copytruncate option. While this configuration seemed to work well when I tested it, I have now experienced some significant limitations that are not documented in the man page:

  1. After rotation, high volume logs files remained the same size and continued to grow
  2. Pre and post rotated high volume log files contained NUL characters
  3. Large sized log files lost messages during logrotate operation

So what caused the issues, what was the impact, and how can you rotate logs messages and not experience these issues?

Continue reading