Network Security Internet Technology Development Database Servers Mobile Phone Android Software Apple Software Computer Software News IT Information

In addition to Weibo, there is also WeChat

Please pay attention

WeChat public account

Shulou

How to build Linux Syslog server simply and efficiently

2025-02-28 Update From: SLTechnology News&Howtos shulou NAV: SLTechnology News&Howtos > Development >

Share

Shulou(Shulou.com)06/01 Report--

This article is about how to build a simple and efficient Linux system log server. I think it is very practical, so I share it with you. I hope you can get something after reading this article. Let's take a look at it.

The log server is to write the log information of several servers into one, so as to achieve the purpose of centralized management.

According to the demand, there are two ways, one is a small number of servers, for example, one or two servers need to be configured to a central server, you can use the first relatively simple way. If more servers need to write to the central server, you need to use the second method, with a few more steps.

The first way: for example, if I want to configure the log files of the A server to the central log server, first specify the central server ip:vi / etc/rsyslog.conf in the A server, and then receive the A server log in the central server: vi / etc/rsyslog.conf

After the central server has configured the directories sent by other servers, it needs to open two modules (remove #) and turn off the firewall: firewall-cmd-set-default-zone=trusted

Test: generate an event on server A, and then go to the central server to see if there is a corresponding log generation: logger-p local6.info 'test1234567'

Central server view:

To add multiple methods, you only need to customize the name received by the central server in the configuration file, such as local6.* in the figure above. However, there is a disadvantage in this way, that is, if multiple servers are matched, it will be very messy to write them all in it, and it is not easy to check the log information of the corresponding servers:

So if the server has more logs, you should classify the a server's logs in the a server host name directory and the b server under the b server host name: so you need to use the second way.

The second way:

First, the servers that set up the logs must be able to resolve each other, and then add the server ip and hostname information to the central server / etc/hosts. Hostname hostname View

Then add storage information at the top of the log storage directory in the central server / etc/rsyslog.conf: fromhost,isequal, "controller" / var/log/controller (log information from controller is stored in this directory, provided that resolution must be added). If only this line is added, although the log will be stored in this directory as scheduled, if it is at the info level, it will also be stored in the messages and other directories of the central server. Obviously, you don't want this to happen, so you still need to add a line,: fromhost,isequal, "controller" ~ (that is, after matching, stop matching and will not write to the log directory of the server) Test: customize events in the server to see if the central server can enter log information normally: [root@controller ~] # logger-p local6.info 'fadsfdsagz1123' [root@block1 ~] # logger-p local6.info 'test123dfgasf1'

The above is how to build the Linux Syslog server simply and efficiently. The editor believes that there are some knowledge points that we may see or use in our daily work. I hope you can learn more from this article. For more details, please follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.

Views: 0

*The comments in the above article only represent the author's personal views and do not represent the views and positions of this website. If you have more insights, please feel free to contribute and share.

Share To

Development

Wechat

© 2024 shulou.com SLNews company. All rights reserved.

12
Report