바로가기 메뉴
본문내용 바로가기
메인메뉴 바로가기



Customer Center

Notice · Security Issue · Account Guide · Global Traffic Test

HOME > Customer Center > Tech Note

기술노트

[LINUX] rsyslog를 이용해서 로그를 리모트 서버로 보내기
2018.05.03

리눅스 서버 로그를 실시간으로 remote 서버에 남기기

1. 로그 보내는 서버

[root@localhost ~]# vi /etc/rsyslog.conf.

.

# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
*.* @@192.168.0.19:514

#*.* @192.168.0.19:514

# @@ TCP 전송 / @ UDP 전송 IP:Port


rsyslog 서비스 재시작

[root@localhost ~]# systemctl restart rsyslog

2. 로그 받는 서버

[root@localhost log]# cat /etc/sysconfig/rsyslog
# Options for rsyslogd
# Syslogd options are deprecated since rsyslog v3.
# If you want to use them, switch to compatibility mode 2 by "-c 2"
# See rsyslogd(8) for more details
SYSLOGD_OPTIONS="-m 0 -r"

[root@localhost log]# cat /etc/rsyslog.conf
# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html

# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html


#### MODULES ####


# The imjournal module bellow is now used as a message source instead of imuxsock.

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)

$ModLoad imjournal # provides access to the systemd journal

#$ModLoad imklog # reads kernel messages (the same are read from journald)

#$ModLoad immark # provides --MARK-- message capability


# Provides UDP syslog reception

$ModLoad imudp

$UDPServerAddress 0.0.0.0

$UDPServerRun 514


# Provides TCP syslog reception

$ModLoad imtcp

$InputTCPServerRun 514


#### GLOBAL DIRECTIVES ####


# Where to place auxiliary files

$WorkDirectory /var/lib/rsyslog


# Use default timestamp format

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat


# File syncing capability is disabled by default. This feature is usually not required,

# not useful and an extreme performance hit

#$ActionFileEnableSync on


# Include all config files in /etc/rsyslog.d/

$IncludeConfig /etc/rsyslog.d/*.conf


# Turn off message reception via local log socket;

# local messages are retrieved through imjournal now.

$OmitLocalLogging on


# File to store the position in the journal

$IMJournalStateFile imjournal.state


#### RULES ####

# Log all kernel messages to the console.

# Logging much else clutters up the screen.

kern.* /var/log/kernel


# Log anything (except mail) of level info or higher.

# Don"t log private authentication messages!

*.info;mail.none;authpriv.none;cron.none /var/log/messages


# The authpriv file has restricted access.

authpriv.* /var/log/secure


# Log all the mail messages in one place.

mail.* -/var/log/maillog


# Log cron stuff

cron.* /var/log/cron


# Everybody gets emergency messages

*.emerg :omusrmsg:*


# Save news errors of level crit and higher in a special file.

uucp,news.crit /var/log/spooler


# Save boot messages also to boot.log

local7.* /var/log/boot.log


# ### begin forwarding rule ###

# ..

# ..

# #

# # This one is the template to generate the log filename dynamically, depending on the client"s IP address.

$template FILENAME,"/rsyslog/%fromhost-ip%/messages-%$YEAR%-%$MONTH%-%$DAY%.log"

# #

# # Log all messages to the dynamically formed file. Now each clients log (192.168.1.2, 192.168.1.3,etc...), will be under a separate directory which is formed by the template FILENAME.

*.* ?FILENAME

# ..

# ..

# # ### end of the forwarding rule ###

rsyslog 서비스 재시작

[root@localhost ~]# systemctl restart rsyslog

3. 결과 확인


#Linux #remotelog #syslog

이호스트데이터센터(http://www.ehostidc.co.kr)

첨부파일