[GRLUG] Rebooting linux server

[Michael Mol]

On Fri, Jul 6, 2012 at 9:58 AM, Collin Kidder <collink at kkmfg.com> wrote:
> On 7/6/2012 9:35 AM, Michael Mol wrote:
>>
>> On Tue, Jul 3, 2012 at 4:07 PM, Adam Tauno Williams
>> <awilliam at whitemice.org> wrote:
>>>
>>> On Tue, 2012-07-03 at 09:20 -0400, Michael Mol wrote:
>>>>
>>>> On Tue, Jul 3, 2012 at 8:24 AM, Collin Kidder <collink at kkmfg.com> wrote:
>>
>> [snip]
>>
>>>>> I'm not exactly a server administration wizard so what should I be
>>>>> looking
>>>>> for to try to figure this out?
>>>>
>>>> Can you leave a laptop hooked up to the serial port and set serial
>>>> port logging? Or even logging to a printer?
>>>
>>> +1
>>
>> In all honesty, this bit of advice came from a "what would whitemice
>> do without reliable disk logs?" moment.
>>
> I've since set up rsyslog to do remote logging to a second machine. Of
> course, now that I've done this the machine has been up for longer than a
> day so far with no hiccups. But, when it happens again I'll be ready. I have
> mcelog installed as well so any mce messages will be remote logged.

My only fear of remote logging is my suspicion it's not quite as
resilient to things like kernel panics as a serial port. But it's a
good step.

Meanwhile, with remote logging set up, you should play around and see
if consolidating your networks' logs might evolve some additional
benefit for you. Perhaps you could shorten your logrotate period on
the source machines and lengthen it on the destination, for example. A
consolidated logging point might be a good place to look for systemic
issues like malicious network scans, too.

Just some thoughts. :)


-- 
:wq