Managed services · Multi-server IT estate

One place to search every server's logs

How we set up centralised syslog for a fleet of Linux servers and network devices, so problems are found in minutes instead of by logging in to each machine.

Built forAn IT team running many Linux servers and network devices

WhereIndia

Used bySystem administrators and the security team

1place to search logs from every server and device

TLSencrypted log transport

Alertson security and health events

Situation

Each server and device kept its own logs, so investigating an outage meant logging in to machines one by one.
Logs were lost when a disk filled up or a server was rebuilt, leaving no record for audits or incident reviews.
There was no early warning for repeated failed logins, disk errors or services that kept restarting.

Task

Collect logs from every server and device in one secure place, kept for an agreed retention period.
Make logs searchable and alert the team on the events that matter.

Action

Built a central syslog server with rsyslog, receiving logs over TLS from Linux servers, firewalls and switches.
Organised logs by host and service, with rotation, compression and a retention policy agreed with the customer.
Added alert rules for failed logins, sudo use, disk and hardware errors and service crashes.
Documented how to onboard a new server or device, and handed over runbooks for the team.