Logging

[bonomani]

Logging

• Logging is very important and could be improved
  • Friendliness
  • Integration with other tools

Inspired by below info, current goal of implementation:

Verbose	Criticity	Xymon
(none)	quiet mode
v	fatal, error	red
vv (default)	warning, minor	yellow, clear(no report)
vvv	info, normal, disable	green, blue(disable), clear(partial report)
vvvv	debug
vvvvv	trace

Syslog Severity to Xymon mapping
Normal = green, blue(disable)
INFORMATIONAL = green, clear(no report)
WARNING = "yellow"
MINOR = "yellow"
SEVERE = "red"
MAJOR "red"
CRITICAL "red"

A small revamp was already done with

• Level, package name, context log
• trace mode

Implemantion with "log4perl"

Prerequisist

• log4perl
• Log::Dispatch
• Time::HiRes
  Question: add to lib or prequiste in install ?

Level

$OFF
$FATAL
$ERROR
$WARN
$INFO
$DEBUG
$TRACE
$ALL

Default

Log default: UNTIL WARN.
-q is "quiet" mode, and shows only the fatal and error log level (-qqq disable?)
-v is "verbose" mode, and shows the info log level
-vv is "debug" mode, and shows the debug log level
-vvv trace?

conf file

Provide maximum flexibility

• Generate default one if not exist, (
  • in devmon top folder
  • If log file or syslog exist (in devmon.cfg)
  • warn if file exist and not consistant with previous option (log and syslog)
• Format: pattern base, with pid, package+module, ....
• Multiple target: Can send to RRD, Elk...and why not not Xymon...
• Example: https://metacpan.org/pod/Log::Log4perl::Config

References

• https://www.perl.com/pub/2002/09/11/log4perl.html/
• http://ddiguru.com/blog/8-useful-log-log4perl-recipes
• https://github.com/sni/Thruk/blob/master/log4perl.conf.example
• Data Security Standard (for Payment Card Industry (PCI), but give a good overview of important information in logs)
  

What log should I have

1. Firewall Log Monitoring
   Deploying security tools such as firewalls alone cannot secure your network completely. Rather, it’s the security data extracted from log monitoring tools which should be analyzed and reported for ensuring network security. A firewall log analyzer can reveal valuable information about the nature of incoming and outgoing traffic and security threat attempts to the administrators.

2. Infrastructure Log Monitoring
   Infrastructure log monitoring is vital for managing policies, equipment, processes and all other resources affecting the enterprise’s IT foundation. To minimize downtime and increase efficiency, IT teams gather and interpret data of each component. Infrastructure log analysis tools also help to monitor Windows event logs or Linux log files.

3. Server Log Monitoring
   A log management software can generate server log monitoring report, which helps you continuously detect and monitor server activities and alert administrators on potential issues or threats before a server problem arises. It helps you assess internal security policies and establish compliance with auditors. The reports generated can also help plan expansion of server capacity.

4. Storage Monitoring
   Storage monitoring provides solution to evaluate storage infrastructure in real-time. A storage monitoring log tool helps to assess the slowdown happening on physical disks and the storage capacity requirements to ensure that there are enough resources for optimal performance, performance of controllers, device ports and physical disks.

Storage Monitoring

5. Login-Logoff Monitoring
   As more organizations are now allowing remote work and flexible working hours, it’s become more important for them to monitor and manage working hours of employees. The log chart can not only track employee login-logoff times, but also keep a record of lock and unlock activities to accurately assess employees time spent on their computer.

A good monitoring report can give an insight into employee attendance, productivity times, overtime threshold and suspicious access times stored in windows log files location. Such reports can give you a better understanding of a user’s connection time and provide detailed, accurate data required by the administration or management for log aggregation and decision making.

6. Application Performance Monitoring
   Application Performance Monitoring or APM detects problems and patterns in an application. It tracks an application’s availability and performance at user’s end. For instance, an IIS log analyzer can tell us about IIS log file location, IIS advanced login option, and IIS error logs, etc.

The IIS log viewer or IIS log reader reports help optimize resource usage to drive a business towards growth. Application monitoring has become easy with log aggregation tools that can produce a real-time insight of application performance and security. The goal of APM reports is to provide insight into quality of experience delivered to end-users.

Application Performance Monitoring 16_5

7. Virtual Machine Monitoring
   As businesses are moving towards virtual IT spaces, virtual machine log monitoring reports have become an essential part of log management. It helps in network security by gathering, analyzing and archiving logs. VM monitoring also aids in managing virtualized tools, which is a very complex task.

Virtual Machine monitoring also helps to track VM resource health and usage, resolve problems in resource allocation, identify root causes of VM downtime and conduct resource planning and management of VMs. A VM monitoring report can provide metrics such as top memory and CPU consumers, network consumers along with health history of every virtual machine.

8. Network Traffic Monitoring
   Network traffic monitoring is a difficult task that is very demanding if handled manually or with free tools. An effective network traffic monitoring tool can help network administrators maintain smooth operation of the network by monitoring performance and traffic throughout the network. It can also verify that no security breach occurs within the network.

Network Traffic Monitoring

9. Database Monitoring
   Database monitoring tracks your database performance and resources to create and maintain highly available and high-performance application infrastructure. For instance, log monitoring SQL log server, Oracle and MySQL database reports include query, session and replication details, scheduled jobs and database performance. Data from all categories is analyzed to prevent or minimize slowdown and database outage.

10. Service Monitoring
    Modern applications come with multiple services to support them. Service monitoring can keep an eye on your IT services and generate reports that help identify and monitor application and customer-defined services and find related issues. Effective monitoring tools will check the services in a hierarchical manner such hard disk capacity, CPU usage, and so on.