- [Instructor] Syslog-ng is a log server
and can also be used to forward logs.
Syslog is a predecessor of syslog-ng.
Ng and syslog-ng stands for next generation.
To live up to its name, syslog-ng must be better and faster
than syslog
What does syslog-ng do?
First of all, it collects logs from various sources.
It forwards the logs do another log management system
or a database.
One of syslog-ng's essential features is filtering.
Without it, the number of logs
will be too overwhelming to manage.
You want to be able to pick and choose the log items
relevant to your security goals.
Filtering is based on the criteria
such as facility and log levels.
Facility refers to the process
that generated a log message on a host.
Each facility has a unique ID.
The facility code for log messages
originating from a mail system process is two
while the code for those created by
an access control process is four.
Therefore you can filter the log messages
according to their facility identifiers.
The log levels represent the severity of the log messages.
The highest level is zero
indicating that the system is unusable.
The lowest level is seven, which is for debugging.
The levels in between are alert,
critical, error, warning,
notice, and informational.
The severity is in the descending order.
Another vital syslog-ng feature
is processing that manipulates the collected logs.
With syslog-ng you should be able to address
most of your logging needs.