Good morning,
The first thing is to know:
- what services do you have installed to send the logs or if you only send the unix syslogs?
- Is the tool already installed to analyze the logs?
After defining this, it is important to be clear that if the network is in production, it must take precautions when applying the changes.
We are at your service.
regards
Jhoan La Cruz
Specialist in Networks and Servers.