Statistics on number of users in 24h period

[Brett Charbeneau]

	Great information and suggestions, Keith!
	And I think you're right on target with the central logging machine for 
this purpose.
	I'm grateful for your help!

-- 
********************************************************************
Brett Charbeneau, GSEC Gold, GCIH Gold
Network Administrator
Williamsburg Regional Library
7770 Croaker Road
Williamsburg, VA 23188-7064
(757)259-4044          www.wrl.org
(757)259-4079 (fax)    brett at wrl.org
********************************************************************


On Thu, 12 Sep 2013, Neufeld, Keith wrote:

NK> > This is the exact tree I was trying to bark up, but I can't seem to get 
NK> > DD-WRT's implementation of DHCP (purported to be 4.1-ESV-R2-1) to log at that 
NK> > level.
NK> 
NK> We have in dhcpd.conf:
NK> 
NK> 	log-facility local1;
NK> 
NK> and then in /etc/syslog-ng/syslog-ng.conf:
NK> 
NK> 	destination d_logh { tcp("syslog.wichita.edu" port(5140)); };
NK> 	destination dhcplog { file("/var/log/dhcp/dhcp.log" perm(0644)); };
NK> 
NK> 	filter f_dhcp { facility(local1); };
NK> 
NK> 	log { source(s_sys); destination(d_logh); };
NK> 	log { source(s_sys); filter(f_dhcp); destination(dhcplog); };
NK> 
NK> which puts the DHCP logs into /var/log/dhcp/dhcp.log and sends a copy to our 
NK> central log server, where a similar configuration teases them out into 
NK> separate applications for central logging.  I'm not a systems guy any more 
NK> so I'm not the one who set up the logging configuration ...
NK> 
NK> Since you mention DD-WRT, I'm assuming you're running dhcpd on a re-flashed 
NK> consumer device.  If that's the case and if you have a Unix/Linux instance 
NK> running somewhere else on commodity server hardware, you may want to use 
NK> that as a central log server rather than burn through write cycles on your 
NK> consumer device's NVRAM.  Or (if you have the option) attach an external USB 
NK> hard drive to your device just for logging.