Install syslog-ng based on CentOS yum

1. Run the following command to view the CentOS version:

[Root @ logsys0 data] # lsb_release-
LSB Version: core-4.0-amd64: core-4.0-noarch: graphics-4.0-amd64: graphics-4.0-noarch: printing-4.0-amd64: printing-4.0-noarch:
Distributor ID: CentOS
Description: CentOS release 6.3 (Final)
Release: 6.3
Codename: Final

2. download and install the EPEL Source

Centos 5.x

[Root @ logsys0 data] # wget http://dl.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm

Centos 6.x

[Root @ logsys0 data] # wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm

[Root @ logsys0 data] # rpm-ivh epel-release-6-8.noarch.rpm3. Install syslog-ng

[Root @ logsys0 data] # yum -- enablerepo = epel install syslog-ng eventlog syslog-ng-libdbi

Setting change: vim/etc/syslog-ng/syslog-ng.conf [root @ logsys0 data] # chkconfig rsyslog off; chkconfig syslog-ng on

[Root @ logsys0 data] # service rsyslog stop; service syslog-ng start

Disable the system logger: [OK]

Start syslog-ng: [OK]
# Reload configuration: service syslog-ng reload
Installed successfully

4. Enable ports 80 and 514 of the firewall

Vi/etc/sysconfig/iptables

Add two rules

-A RH-Firewall-1-INPUT-m state -- state NEW-m tcp-p tcp -- dport 80-j ACCEPT

-A RH-Firewall-1-INPUT-m state -- state NEW-m udp-p udp -- dport 514-j ACCEPT

The configuration file is as follows:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
* Filter
: Input accept [0: 0]
: Forward accept [0: 0]
: Output accept [0: 0]
: RH-Firewall-1-INPUT-[0: 0]
-A input-j RH-Firewall-1-INPUT
-A forward-j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT-I lo-j ACCEPT
-A RH-Firewall-1-INPUT-p icmp -- icmp-type any-j ACCEPT

-A input-m state -- state ESTABLISHED, RELATED-j ACCEPT
-A input-p icmp-j ACCEPT
-A input-I lo-j ACCEPT
-A input-m state -- state NEW-m tcp-p tcp -- dport 22-j ACCEPT
-A RH-Firewall-1-INPUT-m state -- state NEW-m tcp-p tcp -- dport 80-j ACCEPT
-A RH-Firewall-1-INPUT-m state -- state NEW-m udp-p udp -- dport 514-j ACCEPT
-A input-j REJECT -- reject-with icmp-host-prohibited
-A forward-j REJECT -- reject-with icmp-host-prohibited
COMMIT

[Root @ www.bkjia.com data] #/etc/init. d/iptables restart
Iptables: clear firewall rules: [OK]
Iptables: Set the chain to policy ACCEPT: filter [OK]
Iptables: uninstalling module: [OK]
Iptables: Application Firewall Rules: [OK]

Syslog-ng details: click here
Syslog-ng: click here

Set up a log management server in CentOS 5.8 (Syslog-ng + logzilla)

In Linux, how does Syslog-ng modify its facility and level during forwarding?

Use Syslog-ng to build a concentrated log server in RHEL5