Log File Monitoring Tools

Sun Access Manager allows you to perform remote logging and applies the global size-based log file rotation policy to the log files. It does not provide a facility to perform time-based rotation. To overcome this limitation, I had been investigating into the use of external log file monitoring scripts.

While investigation different options, came across two interesting projects hosted by the SourceForge.Net portal.

Swatch - Simple Watcher of Log Files (http://swatch.sourceforge.net/)
LogCheck (http://sourceforge.net/projects/logcheck/)

My preliminary insights into the usage of these tools led me to the conclusion that - while swatch can be used for monitoring different types of log files, logcheck can only be used to monitor log files generated by syslog. Nevertheless these tools seem to be very popular among sysads for monitoring log files in production systems and detecting security violations and unusual activity.

In the process I also realized that what I actually need is a log file managing utility and not a monitoring utility.

If I happen to use these tools, I plan to write more about them.