Using checkmk as a syslog server

Technically, yes, checkmk can be a syslog target. What people mean when they say Checkmk shouldn’t be used as a syslog target is:

  • the event console is optimized for throughput, i.e. throw thousands of events at it, and filter what you care about, discard all the rest

→ the backend of the event console for archiving events is not optimized for holding lots of data. It’s just plain text files, with little to no indexing.

So keeping the logs of 40 servers could work, but don’t be surprised if searching for “event xy” on all servers over the last 90 days runs into a timeout.

(checkmk/history.py at 266b81a4c08a9b19c3c0ad0291531386a3d4a5f0 · Checkmk/checkmk · GitHub mentions a mongodb backend for the event console, but I haven’t found the time to play around with it, and there is no documentation about it that I’m aware of. @mschlenker master of documentation :smiley: is there any :)?)
Old forum posts look like the setup is not straight forward Add Mongodb as an archive mode in the EC

2 Likes