Managing syslog

Log messages are generated by operating systems and applications. These messages contain important information about the health and operation of the system. The messages are also of great significance for security management, audit-checks, and forensics in an intranet. So, a logging system that generates, relays, collects and archives log messages, must be monitored and managed just like all other components of the ICT infrastructure, to ensure that it is operating normally i.e., the logs are being collected and archived as desired. In the Internet, some progress has been made towards the standardization of the syslog protocol but, to date, the management aspect of syslog has been neglected, for all practical purposes. In this paper, we discuss the necessity and importance of monitoring and managing logging systems. We present the basic design of a Management Information Base module which will make it possible to monitor and manage a syslog system using standard management protocols. Then we discuss a prototype implementation of the MIB and demonstrate a syslog management application for managing the syslog configuration of an enterprise.