Shulou(Shulou.com)06/01 Report--

The editor today takes you to understand what is the installation method of the syslog server in the Linux system. The knowledge points in the article are introduced in detail. Friends who feel helpful can browse the content of the article together with the editor, hoping to help more friends who want to solve this problem to find the answer to the problem. Let's follow the editor to learn more about "what is the installation method of syslog server in Linux system?"

Introduction to syslog: on Unix operating systems, syslog is widely used in Syslog. Syslog log messages can be logged in a local file or sent over the network to the server that receives the syslog. The server that receives syslog can store the syslog messages of multiple devices uniformly, or parse the contents of them to deal with them accordingly. The common application scenarios are network management tools, security management system and log audit system.

Step 1: initialize system requirements to set up the linux host as a central log server, we need to create a separate / var partition and allocate enough disk space or create a special LVM volume group. This enables the syslog server to bear the potential growth caused by the cumulative collection of logs.

Step 2: let the rsyslog daemon take effect. The rsyslog daemon comes from the preinstalled module of the current linux release, but it is not started by default. In order to enable the rsyslog daemon to accept external messages, you need to edit its configuration file / etc/rsyslog.conf.

Open the file for editing, find the location of the following two lines, and uncomment by removing the # character at the beginning of the line. (15 lines, 16 lines, 19 lines, 20 lines)

Vi / etc/rsyslog.conf

This allows the rsysolog daemon to accept log messages on UDP port 514-UDP is faster than TCP but does not have the reliability of data streams like TCP. So if you need to use a reliable delivery mechanism, you can uncomment the following lines.

It is important to note that TCP and UDP can be in effect at the same time to listen for TCP/UDP connections. (if both ports are open, the TCP port will not receive logs, so there are two ways: one is to modify the TCP port; the other is to close the UDP port and restart the machine)

Step 3: create a log receiving template for the next step, we need to create a template for remote messages and tell the rsyslog daemon how to log messages received from other client machines.

Use a text editor to open / etc/rsyslog.conf, and then append the following template before the GLOBAL DIRECTIVE block (add under line 23)

Vi / etc/rsyslog.conf

$template RemoteLogs, "/ var/log/%HOSTNAME%/%PROGRAMNAME%.log" *

. ? RemoteLogs

& ~

Here is a brief explanation of the template

The 1.$template RemoteLogs (where the "RemoteLogs" string can be any other descriptive name) directive causes the rsyslog background process to write log messages to a separate local log file under / var/log, where the log file name is defined based on the host name of the remote log sending machine and the name of the application that generated the log.

two。 The second line implies that we apply the RemoteLogs template to all received logs.

3. The symbol "& ~" indicates a redirection rule that is used to tell the rsyslog daemon to stop further processing of log messages and not to write locally. If the redirection rule is not used, all remote messages are written to the local log file in addition to the log file described above, which means that the log message is actually written twice. Another result of using this rule is that log messages from the syslog server itself will only be in proprietary files named after the host name of the machine.

Thank you for reading, the above is the whole content of "what is the installation method of syslog server in Linux system?" learn friends to hurry up to operate it. I believe that the editor will certainly bring you better quality articles. Thank you for your support to the website!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.