Rhel6.0 configure rsyslog To Send Logs to a remote host

1. Configure the server (acceptor ):

[Root @ rhel6-server etc] # Vim/etc/rsyslog. conf
# Provides TCP syslog restart tion
$ Modload imtcp. So
$ Inputtcpserverexecute 514

[Root @ rhel6-server etc] # service rsyslog reload
Reloading system logger... [OK]

[Root @ rhel6-server etc] # netstat-natulp | grep 514
TCP 0 0 0.0.0.0: 514 0.0.0.0: * Listen 5427/rsyslogd
TCP 0 0: 514: * Listen 5427/rsyslogd

2. Configure the client (sender ):

[Root @ rhel6-client log] # Vim/etc/rsyslog. conf
*. * @ Rhel6-server: 514

[Root @ rhel6-client log] # service rsyslog restart
Starting System logger: [OK]

3. server-side Verification:
[Root @ rhel6-server etc] # netstat-natulp | grep 514
TCP 0 0 0.0.0.0: 514 0.0.0.0: * Listen 5427/rsyslogd
TCP 0 0 192.168.17.253: 514 192.168.17.152: 33323 fin_wait2-
TCP 0 0: 514: * Listen 5427/rsyslogd
[Root @ rhel6-server etc] # tail-N 30/var/log/messages | grep rhel6-client
Mar 2 00:42:07 rhel6-client kernel: Kernel logging (Proc) stopped.
Mar 2 00:42:07 rhel6-client rsyslogd: [origin software = "rsyslogd" swversion = "4.6.2" X-pid = "3197" X-Info = "http://www.rsyslog.com"] Exiting on signal 15.
Mar 2 00:43:11 rhel6-client kernel: imklog 4.6.2, log source =/proc/kmsg started.
Mar 2 00:43:11 rhel6-client rsyslogd: [origin software = "rsyslogd" swversion = "4.6.2" X-pid = "3275" X-Info = "http://www.rsyslog.com"] (re) Start
[Root @ rhel6-server etc] #

Ref:

Http://server.51cto.com/sCollege-272392.htm

Http://linux.vbird.org/linux_basic/#syslogd_server