Can zabbiz work as a syslog to ease reporting/monitoring of logs?

[James Wells]

Hmm, this sounds like it contradicts your earlier reply. To clarify, are you saying that if I just want to use zabbix (in addition to monitoring servers) to act as a syslog "storage" and viewing/reporting device that it won't work as well as php-syslog-ng (and syslog-ng)?

I missed that. Sorry. Yes, at present, Zabbix is not as good, but that is almost exclusively a function of the UI. I looked at the code for PHPSyslog-NG and the code is pretty basic stuff. Shouldn't be difficult to integrate it with Zabbix, or at least on a host / item basis. Enabling the multi-host functionality, however, will take a bit more work, but should be fairly easy as well.

EDIT: BTW, that was not meant to be a forward, backward, sideways, whatever slap. The code is clean and well written, it is simply that it is implementing a simple DB query and formatting the output.

[transitv]

Cool, perhaps once 1.4 is out we can get with Alexei and see about the logistics of making these additions. I'd be happy to help (when time permits), but we should start with a full discussion of how it will all work and if it's even worth the trouble...

[Alexei]

I agree. It could very very nice addition to ZABBIX!

[tronite]

Greetings,

Yes and no. By default Zabbix is unable to properly track changes to a syslog style log file. The reason for this is that the Agent doesn't know how to process the time format correctly. However, I have been asked by a couple of people at work to fix this, so unless Alexei fixes it soon, I will be doing so in my bulk patches. Once this is done, you will have not only the features that php-syslog-ng provides, but also, but also the features of swatch and some of the features of splunck and spelunk.

I should point out that Zabbix can support log4j, log4s, and apache style log files.

Seems like you make a habit of saying yes and no.

[toppi]

It must be useful to incorporate a syslog server into Zabbix. Is there any solution in Zabbix 1.8.* version?

[Logicwrath]

I would love to see some integration into zabbix. I think until something like that exists the open source program LogAnalyzer looks promising. I would want the ability to create alerts.

http://loganalyzer.adiscon.com/

I am considering using it myself.

Things I would LOVE include:

splunk style co-relation... yea baby
triggers

[obeiro]

I would love some syslog integration too.

Meanwhile LogZilla is my workaround

http://code.google.com/p/php-syslog-ng/

[zalex_ua]

Guys, look here. This new solution may be of interest to you.

Better syslog message handling for Zabbix

[nelsonab]

LOL!!! This is funny. This thread was started by a spammer, but it has turned out to be somewhat useful. :-)

Splunk is another good tool for log file monitoring. You can even have splunk parse your logs, generate reports which you could conceivably push into Zabbix.

Splunk however does have a drug dealer like model... They give away the first 500MB of logging per month for free, then if you want support it's a few $K but you still only get 500MB, then to get 1GB of logging it twice the price of the 500MB with support, from there the price drops per MB of logging. Be warned, Splunk can chew CPU and disk space almost more than Zabbix.