Logging

All syslog messages from UGCS are sent to charon through syslog-ng. They are then placed in charon:/var/log/<hostname>/<logname> Splunk tail's the log files and gets its input from there.

On the coreservers, none of the messages stay locally, but they do on the shellservers. I'm not exactly sure why.

Syslog logs

local1: apache error logs (poseidon, dionysus) local2: apache access logs (poseidon. dionysus) local3: account stuff (password resets, creation requests)