Rsyslog : Basic Usage2021/09/23 |
|
This is Basic Usage of Rsyslog that is the Log Management Service Daemon.
|
|
| [1] | Stored rules of logging data are configured in [/etc/rsyslog.conf]. |
|
root@dlp:~# grep -v -E "^#|^$" /etc/rsyslog.conf
module(load="imuxsock") # provides support for local system logging
module(load="imklog") # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
*.=debug;\
auth,authpriv.none;\
mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail.none -/var/log/messages
*.emerg :omusrmsg:*
# * how to write rules : (Facility).(Priority) (Action) # # ex : *.info;mail.none;authpriv.none;cron.none /var/log/messages # ⇒ [syslog] messages of [info] Priority of all Facilities are stored in [/var/log/messages] # ⇒ but messages of [mail], [authpriv], [cron] Facilities are not stored in [/var/log/messages] # # * the [-] that is added at the head of a filename means asynchronous output # if [-] is not added, logging data are written with synchronous output # * Facilities # kern : kernel messages # auth : authentication related messages # authpriv : authentication related messages (private) # cron : cron or at related messages # mail : mail services related messages # news : news related messages # uucp : uucp related messages # daemon : daemon services related messages # user : user level processes related messages # lpr : printer related messages # syslog : internal syslog related messages # local0 - local7 : possible to use for custom settings # * Priorities # emerg : maybe panic level troubles # alert : need to correct immediately more than critical # crit : need to correct immediately # err : common errors, non urgent failures # warning : warning messages # notice : not errors but some unusual events detected # info : normal operational messages # debug : debug information # none : none (not output) # * if you'd like to store only specified priority messages # add [=] like follows # ex : kern.=crit /dev/console |
| [2] | To transfer logging data to remote Hosts, Configure like follows. |
|
###### on Syslog Server Host (receives logging data from other Hosts) ###### root@dlp:~# vi /etc/rsyslog.conf # line 20-21 : uncomment
line 22 : set allowed hosts to connect
module(load="imtcp")
input(type="imtcp" port="514")
$AllowedSender TCP, 127.0.0.1, 10.0.0.0/24, *.srv.world
root@dlp:~#
systemctl restart rsyslog
###### on Sender Host (sends logging data to Syslog Server Host) ###### root@node01:~# vi /etc/rsyslog.conf # add to the end
action(type="omfwd"
queue.filename="fwdRule_dlp.srv.world"
queue.maxdiskspace="1g"
queue.saveonshutdown="on"
queue.type="LinkedList"
action.resumeRetryCount="-1"
Target="dlp.srv.world" Port="514" Protocol="tcp")
# queue.filename : queue filename # queue.maxdiskspace : maxdiskspace for queue # queue.saveonshutdown=on : save queue data on disk when system shutdown # queue.type=LinkedList : asynchronous queue which can store 10,000 messages # action.resumeRetryCount=-1 : continue to retry sending when syslog server does not respond # Target=*** : specify syslog server Host
root@node01:~# systemctl restart rsyslog
###### that's OK, verify settings to see logs on syslog server Host ###### root@dlp:~# tail /var/log/auth.log Sep 22 23:24:34 dlp login[437]: pam_unix(login:session): session opened for user root(uid=0) by LOGIN(uid=0) Sep 22 23:24:34 dlp systemd-logind[430]: New session 1 of user root. Sep 22 23:24:34 dlp systemd: pam_unix(systemd-user:session): session opened for user root(uid=0) by (uid=0) Sep 22 23:24:34 dlp login[496]: ROOT LOGIN on '/dev/ttyS0' Sep 23 23:49:15 node01 sshd[1327]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=debian Sep 23 23:49:17 node01 sshd[1327]: Failed password for debian from ::1 port 45454 ssh2 Sep 23 23:49:20 node01 sshd[1327]: Failed password for debian from ::1 port 45454 ssh2 Sep 23 23:49:23 node01 sshd[1327]: Failed password for debian from ::1 port 45454 ssh2 Sep 23 23:49:23 node01 sshd[1327]: Connection closed by authenticating user debian ::1 port 45454 [preauth] Sep 23 23:49:23 node01 sshd[1327]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=debian |
| Sponsored Link |