Looking for Help in Documenting Drupal's Syslog Module

Richard Eriksson - August 1, 2007 - 12:49pm

In October of last year, I wrote a couple of articles, one about openness with regards to open source documentation and another about learning to embrace not knowing everything about the software or service you're documenting. I argued that if you're committed to openness in the support process, then you're also committing to asking for help when you don't know the answer to something. As the support master for Bryght, I've been tasked with writing some documentation for new functionality we added for in our new Bryght Basic profile, i.e. the ability to route system messages to essentially anywhere. This will be part of core for Drupal 6, and it has been backported for our Drupal 5 VPS customers. (Boris posted the reverse bounty, and Khalid came through with a backport.) I've written some skeletal documentation on the new Syslog module, I've been able to figure out and document routing Drupal logs to a file, which you can run the Unix tail command on to get a live view of what's happening on the site:

screenshot of justagwailo.com's syslog tail, with some test data

In that screenshot you can see that I typed in two URLs I knew to throw a 404 error message, tried a URL I knew would get access denied, created a test blog post then deleted it. It contains a lot of information, like the date, the site in question, the URL accessed, and the error/status message.

Where I'm Stuck: Routing the Log Messages Elsewhere

Having a terminal window with a tail of the log is probably good enough for many site administrators with SSH access, but where I'm stuck is to have the status messages routed elsewhere. Interesting examples, which I think are possible, would include:

  • having critical errors routed to email, while other less urgent messages routed to the file log
  • status and error messages via Jabber, which means you can have critical messages sent to your instant messaging program
  • logs going to your iPhone (you must have known that was coming!)

I'm asking for help from the community on how to setup syslog to do more than just routing to a file. Setting up a pipe is well-documented in the syslog.conf manual page, but where to pipe it to and how to get it to a desktop widget or mobile device eludes me. Can someone with a little more Unix system administration help me out with those parts? If you write something that's under a Creative Commons license compatible with ours, then that would make it all the more easy, but if someone points me to the right resources (believe me, I've used the maximum of my Google-fu on this one), than I'm committing to crediting those that help out, and to document it on support.bryght.com as well as Drupal.org (for when it's released as part of core).

Categories: documentation · drupal · syslog · syslog.conf

I did some digging.

Matt V. - August 3, 2007 - 2:45pm

I did some digging around. The O'Reilly book "Building Secure Servers with Linux" has a whole chapter, conveniently the sample chapter available for free, on "System Log Management and Monitoring." It looks like a good starting point, with a lot of detail. Some of the tools mentioned in that chapter and elsewhere include Syslog-ng, LogSurfer, and SWATCH.

In terms of jabber, the only info I was able to find is a blog post on "Using Jabber as a Log Monitor."

I hope some of that helps.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.