Ticket was cloned from Red Hat Bugzilla (product RHEL RFE): Bug 1110412

Problem Definition

The user environment currently uses 5+ FreeIPA servers to manage authentication in different network zones - which may rise eventually. Having all these logs pulled back to a central system will greatly ease the current issues of trying to read log data on all these different machines.

== Log aggregator==
The majority of corporate clients will use (or should use) some form of log aggregator. Whether this is a native rsyslog server collecting logs from all clients, or something more functional such as Logstash, FLuentd, Graylog2, Splunk etc.

The FreeIPA logs are not immediately collectable by these mechanisms without running some form of agent on each client (something which is not always possible based on the last 3 clients I've worked at). The ability to send logs to a remote server on the network via native functionality in rsyslog or journald would allow all FreeIPA logs to end up on the central log server.

Log rotation is generically handled by logrotate. This provides the ability to compress logs once they are rotated out. Our current IPA infrastructure is generating a huge amount of similar data that would compress very well to take up far less disk space.