search technology reviews, news, features, group tests
Popular Searches:   windows , free , asus
Mobile Edition  | 
 |  Register
 |  Newsletters  | 
Sitemap  |  RSS
RSS
Tuesday December 1, 2009 8:35 PM AEST
Skip Navigation LinksPC Authority > Features > Mastering Syslog on small networks
Mastering Syslog on small networks
«»
FEATURE

Mastering Syslog on small networks

by Steve Cassidy  on Aug 16, 2006
The Sorcerer’s Apprentice
Snare converts Windows Event Viewer entries into Syslog messages and uses rules to limit the quantity of delivered messages.
Snare converts Windows Event Viewer entries into Syslog messages and uses rules to limit the quantity of delivered messages.

As any Disney fan will know, there’s an animated version of this fable with the music provided by Dukas, as Mickey Mouse discovers that a good idea to fix a short-term problem can turn into a very bad idea once it encounters the march of time. Syslog reporting can be a good deal like that.

For example, I’ve a firewall that will report in Syslog format, and everything it considers an event – whether it’s an intrusion attempt or a service without a redirector target – gets thrown into the Syslog file, hosted on a nearby Windows server. Believe it or not, I have that Syslog server set to close the old file and open a new one every 100MB (yes, megabytes). It typically opens three or four such files a week. Leave it for a month and you have roughly 2.8GB of Syslog messages – and that’s just one firewall.

This is where the apprentice makes his mistake. When persistent problems strike, diagnosis of what causes the niggling failure can make you think that you should monitor every last packet and twitch that passes through the network or hits the device in question.

For example, let’s say your router or your print server crashes every morning at 5.30am. You don’t want to get up to watch it, you’re fairly sure there’s nobody in the building from the CCTV tapes, and you want to start watching the device from about 3am. I’ve heard of a few hard-core techies watching this kind of situation with a copy of Ethereal (www.ethereal .com), but this isn’t the solution for everyone. Ethereal produces volumes of data that makes Syslog look anaemically under-endowed and depends on long years of experience in assembling packet filters with which to cut down the blizzard of data. You don’t want to see the parity bits in the head and tail of the IP encapsulation of the packet that hits your device 5,000 times in two seconds: what you want is your device to say “buffer overflow due to time zone error” (to quote one example that still scars me) just at that exact right moment.

It’s far simpler to only monitor messages arising from a device with some brains included than it is to wash through all the traffic that incorporates that device. The process is made even more complex, in these times of smart central network switches, by the need to arrange your Ethereal monitor machine on a simple LAN hub with the thing it’s monitoring. Even this relatively humble, almost plain-electrical requirement can have pitfalls – I’ve seen one network reduced to a crawl for months because someone elected to monitor with Ethereal and then forgot to take the server off the 10Mb hub they’d used to permit Ethereal to eavesdrop.

The lesson from my firewall, however, is that, like the Sorcerer’s Apprentice, you can find that turning on all the reporting options simply drowns you in data. For even a small business network, Syslog generators can trivially compose a database that is in reality your largest data store, in terms of number of transactions and horsepower required, to extract a meaningful report.
The rule is: the duller the web page the more valuable the information it presents. At www.precision-guesswork.com there's a comprehensive list of setup guides for generating syslog messages.
The rule is: the duller the web page the more valuable the information it presents. At www.precision-guesswork.com there's a comprehensive list of setup guides for generating syslog messages.

Kiwi Syslog applying filters. Better done on the source device, but if you have no other choice...
Kiwi Syslog applying filters. Better done on the source device, but if you have no other choice...
Copyright © 2009 Dennis Publishing
«»
Email a Friend Email this
Print Page Print this
Tweet This Tweet this
Feedback Send us your tips


Ads by Google

Comments

Be the first to comment on this article.
Thoughts on this article? Add a comment below.
Login or register to submit a comment.
 

Top Stories

Three's a crowd: Microsoft invites the whole family to share Windows 7 discount
Microsoft is offering substantial discount deals on Windows 7 Home Premium packs for families (up to 3 licences) for under $250.
 
The greatest tech U-Turns of all time: Micosoft and the Internet
Believe it or not, but Microsoft weren't always so web friendly. In fact, it was Bill Gates who initially panned the internet and Microsoft's future in it. So what turned it all around?
 
Dell's Studio 17 packs a big screen for a big peformance - pity on the big price
Packed with features, only its value for money lets it escape without an award this month
 


 
Intel
 
Popular
Most Discussed
PC Authority Featured Retailers
hot bargains from the mwave store
City Software, Australia's online computer store with up to 80% off RRP
special offers from dell
Special promotions from the Apple store - Redeem here
PC Authority Featured Retailers
 
Amazing Dell Coupons now available
 
Discover Apple
 

Plan Finder

Powered by WhistleOut

1) Apple iPhone 3GS 16GB35 plans 7%
2) Apple iPhone 3GS 32GB35 plans 8%
3) Nokia N9742 plans 8%
4) Blackberry Curve 85206 plans 6%
5) Blackberry Bold 900014 plans 6%
Three Virgin Mobile Vodafone
« 1 of »
1) iiNet32 plans 8%
2) Netspace33 plans 11%
3) Internode34 plans 11%
4) Optus47 plans 13%
5) Telstra BigPond25 plans 5%

Compare: Mobiles | Broadband

PC Authority