Rsyslog configuration and usage tutorial

Rsyslog configuration and usage tutorial

1. Rsyslog Introduction
Rsyslog is Rocket-fast System for Log processing. Rsyslog is the default Log processing software of CentOS6 series. Rsyslog provides a high-performance and secure log processing system based on its modular design. Rsyslog is multi-threaded and supports enhanced versions of TCP, UDP, TLS, and RELP. Rsyslog.

2. Install Rsyslog

Rsyslog is installed by default in CentOS.
View rsyslog running status

$ Service rsyslog status
Rsyslogd (pid 7542) is running...

$ Ps-ef | grep rsyslog | grep-v grep
Root 1014, 1 0 2014? 00:15:09/sbin/rsyslogd-I/var/run/syslogd. pid-c 5

Here-c 5 is defined in/etc/sysconfig/rsyslog
$ Cat/etc/sysconfig/rsyslog
# Options for rsyslogd
# Syslogd options are deprecated since rsyslog v3.
# If you want to use them, switch to compatibility mode 2 by "-c 2"
# See rsyslogd (8) for more details
SYSLOGD_OPTIONS = "-c 5"

3. Configure rsyslog

Rsyslog configuration file/etc/rsyslog. conf
# Rsyslog v5 configuration file

# For more information see/usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

$ ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ ModLoad imklog # provides kernel logging support (previously done by rklogd)
# $ ModLoad immark # provides -- MARK -- message capability

# Provides UDP syslog resume tion
# $ ModLoad imudp
# $ Udpserverrun514

# Provides TCP syslog restart tion
# $ ModLoad imtcp
# $ Inputtcpserverexecute 514


#### GLOBAL direves ves ####

# Use default timestamp format
$ Actionfiledefatemplate template RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# Not useful and an extreme performance hit
# $ ActionFileEnableSync on

# Include all config files in/etc/rsyslog. d/
$ IncludeConfig/etc/rsyslog. d/*. conf


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
# Kern. */dev/console

# Log anything (could t mail) of level info or higher.
# Don't log private authentication messages!
*. Info; mail. none; authpriv. none; cron. none/var/log/messages

# The authpriv file has restricted access.
Authpriv. */var/log/secure

# Log all the mail messages in one place.
Mail. *-/var/log/maillog


# Log cron stuff
Cron. */var/log/cron

# Everybody gets emergency messages
*. Emerg *

# Save news errors of level crit and higher in a special file.
Uucp, news. crit/var/log/spooler

# Save boot messages also to boot. log
Local7. */var/log/boot. log


#### Begin forwarding rule ###
# The statement between the begin... end define a SINGLE forwarding
# Rule. They belong together, do NOT split them. If you create multiple
# Forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# Down, messages are spooled to disk and sent when it is up again.
# $ WorkDirectory/var/lib/rsyslog # where to place spool files
# $ ActionQueueFileName fwdRule1 # unique name prefix for spool files
# $ ActionQueueMaxDiskSpace 1g #1 gb space limit (use as much as possible)
# $ ActionQueueSaveOnShutdown on # save messages to disk on shutdown
# $ ActionQueueType inclulist # run asynchronously
# $ ActionResumeRetryCount-1 # infinite retries if host is down
# Remote host is: name/ip: port, e.g. 192.168.0.1: 514, port optional
# *. * @ Remote-host: 514
#### End of the forwarding rule ###

 

$ Cat/etc/rsyslog. conf | grep-v-E "^ # | ^ $"
$ ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ ModLoad imklog # provides kernel logging support (previously done by rklogd)
$ Actionfiledefatemplate template RSYSLOG_TraditionalFileFormat
$ IncludeConfig/etc/rsyslog. d/*. conf
*. Info; mail. none; authpriv. none; cron. none/var/log/messages
Authpriv. */var/log/secure
Mail. *-/var/log/maillog
Cron. */var/log/cron
*. Emerg *
Uucp, news. crit/var/log/spooler
Local7. */var/log/boot. log

The configuration format is as follows:

Log Type. Log-level log processing method

Log Type	Description
Auth	Logs generated by the pam module
Authpriv	Logon authentication information for ssh and sftp
Cron	Scheduled task logs
Kernel

-------------------------------------- Split line --------------------------------------

Configure the rsyslog client on CentOS to remotely record logs.

RHEL5.4 deployment of central Log server rsyslog + Log Analyzer

Deploy a log server using Rsyslog + LogAnalyzer + MySQL in CentOS 6.3

Log servers using rsyslog mysql and logAnalyzer

Deploy a log server using Rsyslog + LogAnalyzer + MySQL in CentOS 6.3

RHEL5.4 deployment of central log server rsyslog + loganalyzer

-------------------------------------- Split line --------------------------------------

Rsyslog details: click here
Rsyslog: click here

This article permanently updates the link address: