기술노트

기술노트

게시물 상세
[LINUX] rsyslog를 이용해서 로그를 리모트 서버로 보내기
작성자 : 관리자(jieun@ehostidc.co.kr)  작성일 : 2018-05-03   조회수 : 4011

 

1. 로그 보내는 서버

[root@localhost ~]# vi /etc/rsyslog.conf.

.

# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
*.* @@192.168.0.19:514

#*.* @192.168.0.19:514

# @@   TCP 전송 / @ UDP 전송  IP:Port

 

rsyslog  서비스 재시작

[root@localhost ~]# systemctl restart rsyslog

 

2. 로그 받는 서버

[root@localhost log]# cat /etc/sysconfig/rsyslog
# Options for rsyslogd
# Syslogd options are deprecated since rsyslog v3.
# If you want to use them, switch to compatibility mode 2 by "-c 2"
# See rsyslogd(8) for more details
SYSLOGD_OPTIonS="-m 0 -r"

 

[root@localhost log]# cat /etc/rsyslog.conf
# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html

# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

 

#### MODULES ####

# The imjournal module bellow is now used as a message source instead of imuxsock.

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)

$ModLoad imjournal # provides access to the systemd journal

#$ModLoad imklog # reads kernel messages (the same are read from journald)

#$ModLoad immark  # provides --MARK-- message capability

 

# Provides UDP syslog reception

$ModLoad imudp

$UDPServerAddress 0.0.0.0

$UDPServerRun 514

 

# Provides TCP syslog reception

$ModLoad imtcp

$InputTCPServerRun 514

 

#### GLOBAL DIRECTIVES ####

 

$WorkDirectory /var/lib/rsyslog

 

# Use default timestamp format

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

 

# File syncing capability is disabled by default. This feature is usually not required,

# not useful and an extreme performance hit

#$ActionFileEnableSync on

 

# Include all config files in /etc/rsyslog.d/

$IncludeConfig /etc/rsyslog.d/*.conf

 

# Turn off message reception via local log socket;

# local messages are retrieved through imjournal now.

$OmitLocalLogging on

 

# File to store the position in the journal

$IMJournalStateFile imjournal.state

 

#### RULES ####

 # Log all kernel messages to the console.

# Logging much else clutters up the screen.

kern.*                                                 /var/log/kernel

 

# Log anything (except mail) of level info or higher.

# Don't log private authentication messages!

*.info;mail.none;authpriv.none;cron.none                /var/log/messages

 

# The authpriv file has restricted access.

authpriv.*                                              /var/log/secure

 

# Log all the mail messages in one place.

mail.*                                                  -/var/log/maillog

 

# Log cron stuff

cron.*                                                  /var/log/cron

 

# Everybody gets emergency messages

*.emerg                                                 :omusrmsg:*

 

# Save news errors of level crit and higher in a special file.

uucp,news.crit                                          /var/log/spooler

 

# Save boot messages also to boot.log

local7.*                                                /var/log/boot.log

 

# ### begin forwarding rule ###

# ..

# ..

# #

# # This one is the template to generate the log filename dynamically, depending on the client's IP address.

$template FILENAME,"/rsyslog/%fromhost-ip%/messages-%$YEAR%-%$MONTH%-%$DAY%.log"

# #

# # Log all messages to the dynamically formed file. Now each clients log (192.168.1.2, 192.168.1.3,etc...), will be under a separate directory which is formed by the template FILENAME.

 *.* ?FILENAME

# ..

# ..

# # ### end of the forwarding rule ###

 

 rsyslog  서비스 재시작

[root@localhost ~]# systemctl restart rsyslog


3. 결과 확인   

 

#Linux #remotelog #syslog

이호스트데이터센터(http://www.ehostidc.co.kr)


이전글 [Linux] LVM 생성
다음글