Monitoring if Server is still sending logs

General Feedback Request For Comments
1

Hi all,

we had a problem that something was changed in our production environment and we didn’t have the logs at that time because the log shipper was not configured.
I now have the task of monitoring each server and checking if each one is still sending all the logs and if not, alerting so we can fix it.

My question now is if anyone has already built something similar that works perfectly.
Our requirement is to check if each log is still indexed, i.e. Windows Event Logs and IIS Logs.

Thanks in advance

2

What I generally do, we have all sorts of log metadata from which specific application, environment etc, is just create a monitor to check if the log count drops substantially based on the previously mentioned dimensions, if it does we send an alert saying applicationX in EnvironmentY has reduced logging output, please investigate.