<HTML >
<HEAD>
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</HEAD>
<BODY lang=EN-US link=blue vlink=blue style='word-wrap: break-word;-webkit-nbsp-mode: space;
-webkit-line-break: after-white-space'>
<DIV>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Thanks – I had in fact already begun
working on the ssh with tail –f – I was just wondering if there wasn’t some
prebuilt tool already designed to do this. Something like a reverse syslog or
logwatcher.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>
ale-bounces@ale.org [mailto:ale-bounces@ale.org] <b><span style='font-weight:
bold'>On Behalf Of </span></b>Kenneth Ratliff<br>
<b><span style='font-weight:bold'>Sent:</span></b> Friday, March 20, 2009 7:46
PM<br>
<b><span style='font-weight:bold'>To:</span></b> ale@ale.org<br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [ale] Pulling log
entries rather than pushing from DMZ host</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>On Mar 20, 2009, at 5:27 PM, Jim Popovitch wrote:<o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><br>
<br>
<o:p></o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>2009/3/20 Jeff Lightner <<a href="mailto:jlightner@water.com">jlightner@water.com</a>>:<br>
<br>
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>We have a need to monitor logs for Tomcat and Apache on a new web
server<o:p></o:p></span></font></p>
<blockquote style='margin-top:5.0pt;margin-bottom:5.0pt' type=cite>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>that is of course in DMZ.<o:p></o:p></span></font></p>
</blockquote>
<blockquote style='margin-top:5.0pt;margin-bottom:5.0pt' type=cite>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</blockquote>
<blockquote style='margin-top:5.0pt;margin-bottom:5.0pt' type=cite>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>I know I can use syslog to sends logs from this host inside the
firewall but<o:p></o:p></span></font></p>
</blockquote>
<blockquote style='margin-top:5.0pt;margin-bottom:5.0pt' type=cite>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>I don’t want to initiate traffic from inside the DMZ.<o:p></o:p></span></font></p>
</blockquote>
<blockquote style='margin-top:5.0pt;margin-bottom:5.0pt' type=cite>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</blockquote>
<blockquote style='margin-top:5.0pt;margin-bottom:5.0pt' type=cite>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Is there any tool that would let me initiate a connection from my
internal<o:p></o:p></span></font></p>
</blockquote>
<blockquote style='margin-top:5.0pt;margin-bottom:5.0pt' type=cite>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>hosts to the DMZ host and pull log entries as they occur?<o:p></o:p></span></font></p>
</blockquote>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><br>
There's a million ways... ;-) It all depends on what you want to do<br>
with the data you pick up.<br>
<br>
Here's some examples:<br>
<br>
ssh host.domain.tld tail -f /var/log/apache/access.log ><br>
host.domain.tld.log & tail -f host.domain.tld.log<br>
<br>
ssh host.domain.tld tail -f /var/log/apache/access.log |<br>
/usr/local/bin/script-on-local-pc<br>
<br>
etc.<br>
<br>
-Jim P.<o:p></o:p></span></font></p>
</div>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Aww, cmon, no netcat? /grin<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
</div>
</DIV>
<DIV> </DIV>
<DIV>
<FONT FACE="Arial" COLOR="green" SIZE="1"><EM>Please consider our environment before printing this e-mail or attachments.</EM></FONT>
</DIV>
<DIV STYLE="FONT-SIZE: 9pt; FONT-FAMILY: Courier New">
<FONT FACE="Arial" SIZE="2">----------------------------------<BR>CONFIDENTIALITY NOTICE: This e-mail may contain privileged or confidential information and is for the sole use of the intended recipient(s). If you are not the intended recipient, any disclosure, copying, distribution, or use of the contents of this information is prohibited and may be unlawful. If you have received this electronic transmission in error, please reply immediately to the sender that you have received the message in error, and delete it. Thank you.<BR>----------------------------------<BR></FONT>
</DIV></BODY></HTML>