Configure linux as log service host for PIX, cisco, and huawei

Configure linux as log service host of PIX, cisco, and huawei-Linux Enterprise Application-Linux server application information. The following is a detailed description. Log host settings

Vi/etc/sysconfig/syslog

Set

SYSLOGD_OPTIONS = "-m 0"

Change

SYSLOGD_OPTIONS = "-r-m 0" //-r writes from the remote host-m 0 sables 'mark' messages

Vi/etc/syslog. conf

Add the following content

Record all logs with the device number local4 (the default device Number of the PIX) to/var/log/router. log.

# Save pix messages all to router. log

Local4. */var/log/router. log

Record all logs whose device number is local5 (specified by info-center loghost-ip-addr facility local-number in S8016) to/var/log/router. log.

# Save S8016 messages all to S8016.log

Local5. */var/log/S8016.log

Generate an empty log file

Touch/var/log/router. log

Touch/var/log/S8016.log

Restart syslog.

/Etc/rc. d/init. d/syslog restart

Do not forget to Set firewall rules to allow only your devices to send to udp/514 (the default UDP port is 514, and the default tcp port is 146 ).

To avoid excessive logs, configure log rotation (man logrotate to view detailed help information)

Vi/etc/logrotate. conf

Add the following content

# System-specific logs may be also be configured here.

/Var/log/router. log (

Rotate 2

}

/Var/log/S8016.log {

Weekly // weekly round robin

Rotate 4 // round robin 4 times

}

Configure crontab to back up logs, for example, by date.

If there are many network devices, you can configure similar devices as the same device number.

Example: more switch. log | grep X. X // view the log of a device.

It is very important to review and record system events. If you only record system events as logs and do not view them, it will not help. You can use webadmin to manage and view logs, use logchek to Automatically Check log files, remove normal log information, and retain problematic logs, then, email the information to the system administrator. (Supplemented later)

Network Device Configuration

Configuration of the PIX

Logging on // open the log

Logging host [if_name] ip_address [protocol/port] // specify the log host

Example: logging host log 133.3.3.2

Logging trap level // specify the log message level (0: Emergency (Emergencies) 1: Alarm (Alerts) 2: severe (Critical) 3: Error (Errors) 4: warning 5: Notifications 6: Information 7: Debugging ))

Logging trap 7 // set the debugging information to the Debug level, and record the FTP command and WWW URL

In addition, you can use the logging facility command to change the device number. The default value of PIX is local4 (20)

Configuration of Huawei S8016 (VRP (R) Software, Version 3.10 (NSSA), RELEASE 5331)

Huawei S8016 new command line Setting Log Server

Info-center enable // open the Information center

Inf-center loghost-ip-addr channel 2 facility local-number

Set the IP address of the log host

Info-center logging host-ip-addr

Set the log host information channel

Info-center host-ip-addr channel {channel-number | channel-name}

Set logging host Logging Tool

Set logging host-ip-addr facility local-number

Cancel output to log host

Undo info-center loghost host-ip-addr

Huwei S3026 configuration (VRP (tm) Software, Version 3.10)

Logging on

Set logging host 133.3.3.2 channel 2 language chinese facility local1

Cisco 7505 Configuration

Logging 133.3.3.2

Logging on

Logging trap 6

Logging facility local0