Linux Centralized log server Rsyslog

Linux can usually be rsyslog to achieve centralized management of the system log, in which case there will usually be a log server, and then each machine configures its own log through the Rsyslog to write to the remote log server.

This assumes that there are two servers, one for the system log server (such as machine name Logmaster), and the other as a log client (such as machine name Logclient)

Log server Configuration

First modify the/etc/rsyslog.conf file on the log master machine to remove the comments from the four lines below

$ModLoad imudp$UDPServerRun514$ModLoad imtcp$InputTCPServerRun514

Then restart the RSYSLOGD service

sudo /etc/init.d/rsyslog restart

Log Client Configuration

Modify the/etc/rsyslog.conf file on the log node machine
In the end, add the following line to allow Linux to write a log at the same time to write a copy to the remote log Mater machine

*.*         @logmaster

Then restart the RSYSLOGD service

sudo /etc/init.d/rsyslog restart

Test

On Linxu, you can use the Logger command to write a system log, such as

$ ‘hello world‘

Then look at the/var/log/messages file on the log master machine and you can see something like this

Jun 28 14:58:16logclientroothelloworld

This includes the date, log source (machine name), process name, and log content.

Please indicate this address in the form of a link.
This address: http://blog.csdn.net/kongxx/article/details/46671575

Linux Centralized log server Rsyslog