#######
ABOUT
#######
Glug stands for Graph Logs Using Glug. It creates graphs showing log activity for your systems. It is based on the premise that most log messages are only interesting in terms of their frequency.
It was developed and tested on Debian and RedHat GNU/Linux, but should work with minor modification on any UNIX-like system, including Cygwin.
It was written by Elliot Kendall <glug@dx4.org>. Comments, suggestions and patches are welcome.
###############
PREREQUISITES
###############
- RRDtool (http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/)
- The logtail utility, which comes with logcheck (http://alioth.debian.org/projects/logcheck)
- UNIX syslog data (preferably from multiple machines)
- Cron or something similar
#############
QUICK START
#############
1. Have a setup in which all your syslog-capable hosts are pushing their
logs to a central repository. See "LOGGING," below, for more information.
2. Log into the repository machine
3. Download and unpack the glug tarball
4. Run "make install"
This will install scripts in /usr/local/bin, put configuration files in /etc/glug, prepare directories for RRDs and graph images in /var/local/glug, and install a cron job in /etc/cron.d to run Glug every 10 minutes.
5. Edit /etc/glug/glug.conf and make sure everything looks good. You will definitely have to change the LOGFILES parameter if you aren't running Debian.
6. Symlink /var/local/glug/graphs into your web server's document root.
#########
LOGGING
#########
To use this program effectively, you should have a number of machines
sending their syslog messages to a central repository machine. This
requires changes on both the client (log sender) and server (log collecter)
machines.
On the server:
Make sure that syslogd runs with the "-r" option. On RedHat, this should
be set in /etc/sysconfig/syslog. In Debian and probably most other systems,
this should be set in /etc/init.d/sysklogd or whatever script starts
the syslog daemon.
On the client:
Add something like this to /etc/syslog.conf:
local5. @yourloghost mail.;*.info;uucp.none @yourloghost
Note that the whitespace must be TABS, not spaces. Replace "yourloghost" with the IP address or valid hostname of your log server.
##################
ACKNOWLEDGEMENTS
##################
Inspired by Marcus Ranum's excellent System Log Aggregation, Statistics,
and Analysis class at USENIX Technical Conference 2004.
#########
LICENSE
#########
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA