Set up rsyslog log server using centos

Set up rsyslog log server using centos

The system is centos 6.5x64

Server

Yum install-y rsyslog

Mkdir/data/log

Vi/etc/sysconfig/rsyslog

# SYSLOGD_OPTIONS = "-c 5"

# R indicates that receiving is allowed, x indicates that DNS resolution is not required, and m indicates that 0 is synchronized immediately.

SYSLOGD_OPTIONS = "-r-x-m 0"

Cp/etc/rsyslog. conf/etc/rsyslog. conf. bak

Vim/etc/rsyslog. conf

10 $ ModLoad immark # immark is the module name and supports log marking.

13 $ ModLoad imudp # imupd is the module name and supports udp protocol

14 $ UDPServerRun 514 # Allow port 514 to receive logs forwarded over UDP and TCP

24 # $ actionfiledefatemplate template RSYSLOG_TraditionalFileFormat # default log template, which sends the host name by default. If you need to send an IP address, add the following two lines.

25 $ template myFormat, "% timestamp % fromhost-ip % msg % \ n"

26 $ actionfiledefatemplate template myFormat

44 # *. info; mail. none; authpriv. none; cron. none/var/log/messages

45 *. info; mail. none; authpriv. none; cron. none/data/log/messages # custom storage path

Restart rsyslog

/Etc/init. d/rsyslog restart

Check whether the port is enabled

Netstat-napulu | grep 514

Udp 0 0 0.0.0.0: 514 0.0.0.0: * 8757/rsyslogd

Client

Yum install-y rsyslog

Vim/etc/rsyslog. conf

24 # $ actionfiledefatemplate template RSYSLOG_TraditionalFileFormat

25 $ template myFormat, "% timestamp % fromhost-ip % msg % \ n"

26 $ actionfiledefatemplate template myFormat

45 *. info; mail. none; authpriv. none; cron. none @ 10.169.13.219 # send to log server

Restart rsyslog

/Etc/init. d/rsyslog restart

Server tracking log

Tail-f/data/log/messages

Client test and restart nrpe

Killall-9 nrpe

/Usr/local/nagios/bin/nrpe-c/usr/local/nagios/etc/nrpe. cfg-d

/Usr/local/nagios/libexec/check_nrpe-H localhost

The server has seen logs.

May 14 15:37:25 10.168.23.20.starting up daemon

May 14 15:37:25 10.168.23.20.listening for connections on port 5666

May 14 15:37:25 10.168.23.232 Allowing connections from: 10.252.119.80, 127.0.0.1

Add startup items for servers and clients

Echo "/etc/init. d/rsyslog start">/etc/rc. local

If the log format displayed on the server does not match the format, you can customize the format.

Modify vim/etc/rsyslog. conf on the server

For example

$ Template myFormat, "% fromhost-ip % ^ % msg % \ n"

Then reference

Local4. *-/data/log/messages; myFormat

Restart rsyslog.

This article from the "Fallen Star" blog, please be sure to keep this source http://xiao987334176.blog.51cto.com/2202382/1652325