Originally posted by: Max_YU

Hi,

We use different AIX (7.1) servers. We like to have a centralized log management server for logs management (logs for system and applications).

What technical options, solutions, tools are available in order to do this ?

Thanks a lot

 

Originally posted by: strikr

Max, how about configuring a Linux server running syslog-ng as a centralized log host ?

You could then install syslog-ng on the AIX servers and configure it to send logs to your Linux server.

Subsequently you may wish to install analytics tools on the Linux server for working with the logs of the system and applications.

We have deployed this for a customer and hence sharing this approach.

What are your thoughts ?

 

Originally posted by: Max_YU

Hi,

thanks for your reply.

It is effectively a solution. I found articles for this subject describing ELK stack  usage (elasticsearch logstash kibana) but mainly for Linux platforms in order to implement a centralized logs platform.

Thanks 

 

Originally posted by: strikr

Yes, ELK on Linux works quite well given high quality packaging and is a cost effective solution.

You could setup a Gentoo / Arch Linux and build/install the packages.

 

Unless AIX doesn't open up its packaging infrastructure (and i'm not referring to RPM/yum.sh disaster) to outside FOSS contributor's, Linux will continue to be the platform of choice.

 

If you are up for real exploration, i'd like to draw your attention pf 'pkgsrc' (portable package build system)

http://wiki.netbsd.org/pkgsrc/how_to_use_pkgsrc_on_aix/

 

first things first

gcc toolchain, still needs to be installed from that abomination called RPM/yum.

 

Elastic Search

http://cdn.netbsd.org/pub/pkgsrc/current/pkgsrc/databases/elasticsearch/README.html

 

Log Stash

You are going to need JDK 8 and JRuby 9.1

https://github.com/elastic/logstash

 

Kibana

you are going to build node.JS

http://cdn.netbsd.org/pub/pkgsrc/current/pkgsrc/lang/nodejs8/README.html

and then

https://github.com/elastic/kibana

 

Guess one needs to put in some time and effort, but it's doable !

Originally posted by: AncientAIXer

No need to install syslog-ng on AIX.  AIX syslog can be configured to forward entries to another syslog server or to the centralized syslog-ng server.