ubuntu 16.04 设置syslog接收远程主机日志

Server:

首先,如果没有安装rsyslog,先要安装rsyslog(sudo apt-get install rsyslog), 确保监听日志发送端口

514, 编辑/ect/rsyslog.conf 文件如下:

# provides UDP syslog reception#$ModLoad imudp#$UDPServerRun 514# provides TCP syslog reception#$ModLoad imtcp#$InputTCPServerRun 514

修改为:

# provides UDP syslog reception$ModLoad imudp$UDPServerRun 514# provides TCP syslog reception$ModLoad imtcp$InputTCPServerRun 514

保存并重启服务service rsyslog restart




然后,以root身份修改rsyslog启动配置文件(Ubuntu在/etc/default/rsyslog下)


# Options to syslogd# -m 0 disables 'MARK' messages.# -r enables logging from remote machines# -x disables DNS lookups on messages recieved with -r //禁用掉dns记录项不够齐全或其他的日志中心的日志# See syslogd(8) for more details# 
SYSLOGD_OPTIONS="-r" #SYSLOGD_OPTIONS="-r -x -m 180" 
# 加 -r 选项以允许接受外来日志消息# 加 -x 禁用掉dns记录项不够齐全或其他的日志中心的日志# 加 -m 修改syslog的内部mark消息写入间隔时间（0为关闭）。例如-m 180，表示每隔180分钟（每天8次）在日志文件里增加一行时间戳消息# 加 -h 默认情况下，syslog不会发送从远端接受过来的消息到其他主机，而使用该选项，则把该开关打开，所有接受到的信息都可根据syslog.conf中定义的@主机转发过去。# Options to klogd# -2 prints all kernel oops messages twice; once for klogd to decode, and#    once for processing with 'ksymoops'# -x disables all klogd processing of oops messages entirely# See klogd(8) for more detailsKLOGD_OPTIONS="-x"#SYSLOG_UMASK=077# set this to a umask value to use for all log files as in umask(1).# By default, all permissions are removed for "group" and "other". 

完成服务端设置.

Client:

编辑 vi /ect/rsyslog.conf 文件如下:

# Log all kernel messages to the console.# Logging much else clutters up the screen.#kern.*                                                 /dev/console# Log anything (except mail) of level info or higher.# Don't log private authentication messages!*.info;mail.none;authpriv.none;cron.none                /var/log/messages# The authpriv file has restricted access.authpriv.*                                              /var/log/secure####这里设置发送的服务器地址authpriv.*  @服务器IP# Log all the mail messages in one place.mail.*                                                  -/var/log/maillog# Log cron stuffcron.*                                                  /var/log/cron# Everybody gets emergency messages*.emerg                                                 *# Save news errors of level crit and higher in a special file.uucp,news.crit                                          /var/log/spooler# Save boot messages also to boot.loglocal7.*                                                /var/log/boot.log# 写成这样就是把所有的信息都同步过去*.* @服务器IP