Log Management — Centralised Log Collection

Centralised log collection and storage

With one server, logs get read on that server. With several, and when you need answers fast, you need somewhere they are all gathered together and searchable.

What is included

• collecting logs from the web server, PHP, the database and the application itself;
• a single store searchable by time, source and text;
• rotation and retention — so logs do not eat the disk;
• alerts on critical events: error spikes, access denials, a service going down;
• parsing application logs into structured fields, where the format allows.

What it is genuinely for

The most common scenario is incident analysis. The site went down overnight and in the morning you need to know why. Without central collection you log into the server, hunt for the right file and line up timestamps across several logs by hand. With it, one search over a time range.

The second scenario is catching problems before complaints arrive. The number of 500 errors creeping up over a week is invisible in daily reading and obvious on a chart.

About volume

Logs grow faster than expected — an active store produces gigabytes a month. So retention period and detail level are agreed in advance: keeping everything forever is expensive and pointless.