Log server syslogd for Linux systems

System logs are information that records hardware, software, and system problems in the system, and can also monitor events that occur in the system. It allows the user to check the cause of the error, or to look for traces left by the attacker in the event of an attack.

The Event Viewer for Windows is a log system. The Linux log system is created by installing the SYSKLOGD package to form two services:

/SBIN/KLOGD for hardware (for cores, many hardware-related)

/SBIN/SYSLOGD for Software (syslog server for the system)

To view hardware-related logs:

[[email protected] ~]# DMESG |grep-i CPU View information about the CPU

[[email protected] ~]# DMESG |grep-i mem View Memory related information

[Email protected] ~]# DMESG |grep-i eth0 View information about eth0

Network devices: Routers, firewalls, switches, etc. all have their own log capabilities.

The purpose of the log is to let us know the changes of the system in time to help us make some diagnoses.

Category files for logs:/etc/syslog.conf

　　

　　

As you can see from the Man Handbook, the first column of the log classification file represents the type of log and the level of the log, and the second column represents the action taken on the log specified in the first column.

The usual actions are taken by three kinds:

1. Write the specified type log to the file (file name)

2. Send the specified type log to each user currently logged on to the system (*)

3. Send the specified type log to another log server (@ address)

To implement a log server on Linux:

1. Turn on log service

　　

The system is turned on by default.

2. Edit the configuration file

　　

The Add-r option indicates that logs from other hosts are allowed to be logged.

3. Restart Service

　　

At this point, the log server is configured to complete. Next, open another Linux virtual machine, as the application server, which is the client in the log schema, to test.

4. Test:

In the client edit/etc/syslog.conf file, modify the action listed as: @ Log server address. Restart the log service.

　　

Observe the log information sent by the client on the server.

　　

You can see that the client's log information is displayed on the server side.

Windows implementation Log server: You need to install a third-party software KIWI_SYSLOGD log server.

Log server syslogd for Linux systems