<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>I suggest looking into syslog-ng for centralized log server.
Clients can use rsyslog for unix and nxlog for windows. Syslog-ng
is scalable, high speed and provides a lot of features for
parsing, alerting, co-relating etc. You can Use Syslog-ng for
central log collection, send it to elasticsearch , analyze with
Kibana and visualize with grafana. I have been using all this on a
VM with 4G of RAM and 2 Cores of VCPU and seems to be working
okay. 15 servers including web and mail servers are sending logs
to the Log server. Additionally, I am also using wazuh for
alerting and sending data to elastic search as well. I believe,
the resource requirement will depend on the EPS rather than number
of hosts. <br>
</p>
<p>Thank You !<br>
</p>
<pre class="moz-signature" cols="72">Amit K Nepal
(OSCP, CISM, CISSP, RHCE, CCENT, C|EH, C|HFI, GIAC ISO 27000 Specialist)
</pre>
<div class="moz-cite-prefix">On 12/12/2018 2:09 PM, Snyder,
Alexander J wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAAqYjtOH-5Pr=Jt3EtQ_qomEr-2GPNCc5Mr9a8qb9s0SOPGY3w@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="auto">Looking for suggestions on what kind of physical
resources would suggested to building a central logging server
for an enterprise company.
<div dir="auto"><br>
</div>
<div dir="auto">rsyslog is new for the company, so we're looking
to "do it right" from the ground up.</div>
<div dir="auto"><br>
</div>
<div dir="auto">How many hosts should be needed to log
networking and storage appliances?</div>
<div dir="auto"><br>
</div>
<div dir="auto">Advice on memory, CPU, and disk are requested.
Will be running CentOS7.<br>
<br>
<div data-smartmail="gmail_signature" dir="auto">Thanks,<br>
Alexander.<br>
<br>
Sent from my Samsung Galaxy S8+</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">---------------------------------------------------
PLUG-discuss mailing list - <a class="moz-txt-link-abbreviated" href="mailto:PLUG-discuss@lists.phxlinux.org">PLUG-discuss@lists.phxlinux.org</a>
To subscribe, unsubscribe, or to change your mail settings:
<a class="moz-txt-link-freetext" href="https://lists.phxlinux.org/mailman/listinfo/plug-discuss">https://lists.phxlinux.org/mailman/listinfo/plug-discuss</a></pre>
</blockquote>
</body>
</html>