Digging into Engine Yard Logs | Engine Yard Blog

Digging into Engine Yard Logs, thanks to @logentries

However, the main syslog file tends to capture a lot of events from different sources (it depends on your syslog configuration , located at /etc/syslog.conf, which specifies what events to send to your different syslog files) and in some cases you may want to dip into one of the more specific files if you know, exactly what you are interested in. For example the auth.log file captures any ssh access or attempted ssh access to your instance. It’s a good idea to regularly review this file and maybe even set alerts around successful log ins, so that you know when someone logs into your box. The screen shot below shows an example of what a successful dictionary attack on a server instance would look like. You can see in my Logentries account (below) I have tagged both the unsuccessful and successful login attempts to highlight these. If you are running some cloud instances, yo...

Full article: http://www.engineyard.com/blog/2012/digging-into-engine-y...