Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen der Seite angezeigt.

--- admin_grundlagen:syslog [2013/09/12 10:30] – angelegt ingo_wichmann
+++ admin_grundlagen:syslog [2025/04/04 07:43] (aktuell) – [Zielrechner:] ingo_wichmann
@@ Zeile 1: / Zeile 1: @@
-====== syslog ======
+====== rsyslog ======
 Beispiel: Logdaten von einem Rechner auf den nächsten übertragen
 ===== Zielrechner: =====
 Zielrechner netzwerkfähig machen:
+Passende Nachrichten in Datei ''/var/log/beispiel'' schreiben:
-''/etc/sysconfig/syslog'' : ( Centos 5 )
+=== Debian, CentOS, Ubuntu ===
+''/etc/rsyslog.d/10-remote.conf'': ( debian 5.0, centos 6.0, ubuntu 18.04 )
 <file>
-SYSLOGD_OPTIONS="-m 0 -r"
+$ModLoad imudp
+$UDPServerRun 514
+$template RemoteHost,"/var/log/remote/%HOSTNAME%.log"
+local5.info ?RemoteHost
 </file>
-''/etc/sysconfig/syslog'': ( openSuSE 11.1 )
+Syntax der Konfigurationsdatei überprüfen:
-<code bash>
+  rsyslogd -N1
-  SYSLOGD_PARAMS="-r"
+((http://www.rsyslog.com/how-can-i-check-the-config/ ))
-</code>
-''/etc/default/syslogd'': ( debian 4.0 )
+Syslog neu starten:
-<code bash>
+  service rsyslog restart
-  SYSLOGD="-r"
-</code>
-Passende Nachrichten in Datei '/var/log/beispiel' schreiben:
+=== SuSE ===
+''/etc/rsyslog.d/remote.conf'': ( openSuSE Leap 15.6 )
+<file>
+# ######### Receiving Messages from Remote Hosts ##########
+# TCP Syslog Server:
+# provides TCP syslog reception and GSS-API (if compiled to support it)
+# see https://www.rsyslog.com/receiving-messages-from-a-remote-system
+module(load="imtcp")
+input(type="imtcp" port="514" Address="0.0.0.0")
-''/etc/syslog.conf'' :
+# UDP Syslog Server:
-<file>
+module(load="imudp")
-local5.info     -/var/log/beispiel
+input(type="imudp" port="514" Address="0.0.0.0")
 </file>
+Syntax der Konfigurationsdatei überprüfen:((http://www.rsyslog.com/how-can-i-check-the-config/ ))
+  rsyslogd -N1
 Syslog neu starten:
-  /etc/init.d/sysklogd restart
+  systemctl restart syslog
 ===== Absender-Rechner: =====
-/etc/syslog.conf:
+''/etc/rsyslog.d/local5.conf'' :
+<file>
   local5.info     @zielrechner
+</file>
 Syslog neu einlesen:
-  /etc/init.d/sysklogd restart
+  service rsyslog restart
 Testen: Meldung abschicken:
   logger -p local5.info "Testmeldung"
+Über's Netz direkt an syslog-Server:
+  logger -p local5.info -n notebook03 --tcp --port 514 "tcp test"
-====== rsyslog ======
+===== property based filter =====
-Beispiel: Logdaten von einem Rechner auf den nächsten übertragen
+Auf dem Zielrechner:
-===== Zielrechner: =====
+<file /etc/rsyslog.d/45-remote-filter.conf>
-Zielrechner netzwerkfähig machen:
-Passende Nachrichten in Datei ''/var/log/beispiel'' schreiben:
-=== Debian, CentOS ===
+:syslogtag, isequal, "ingo:"          /var/log/ingo.log
-''/etc/rsyslog.conf'': ( debian 5.0, centos 6.0 )
+&                                     ~ # in der vorherigen Zeile ausgegebene Meldungen nicht erneut ausgeben
-<file>
+:source , !isequal , "notebook02"     ~
-  $ModLoad imudp
-  $UDPServerRun 514
-  local5.info     -/var/log/beispiel
 </file>
-Syslog neu starten:
-  service rsyslog restart
-=== SuSE ===
-''/etc/rsyslog.d/remote.conf'': ( sles 11 SP 1 )
-<file>
-  $ModLoad imudp
-  $UDPServerRun 514
-</file>
-''/etc/rsyslog.conf'': ( debian 5.0 )
-<file>
-  local5.info     -/var/log/beispiel
-</file>
-Syslog neu starten:
-  /etc/init.d/syslog restart
-===== Absender-Rechner: =====
-/etc/rsyslog.conf:
-  local5.info     @zielrechner
-Syslog neu einlesen:
-  /etc/init.d/rsyslog restart
-Testen: Meldung abschicken:
-  logger -p local5.info "Testmeldung"
 ====== syslog-ng ======
@@ Zeile 168: / Zeile 158: @@
 ====== Doku ======
-  * Facility:
+Jede Logmeldung besitzt eine __priority__\\
-''auth, authpriv, cron, daemon, kern, lpr, mail, mark, news, security (same as  auth),  syslog, user, uucp and local0'' bis ''local7''
+die sich zusammensetzt aus einer __facility__ und einem __level__:\\
-  * Level:
+prio=fac.level
+==== Facility ====
+Nicht jedes Linux/Unix hat alle Facilities:
+<file>
+  Facility        Description
+  ----------------------------
+  auth/security   Activity related to requesting name and password (getty, su, login)
+  authpriv        Same as auth but logged to a file that can only be read by selected users
+  console         Used to capture messages that would generally be directed to the system console
+  cron            Messages from the cron system scheduler
+  daemon          System daemon catch-all
+  ftp             Messages relating to the ftp daemon
+  kern            Kernel messages
+  local0.local7   <Local facilities defined per site
+  lpr             Messages from the line printing system
+  mail            Messages relating to the mail system
+  mark            Pseudo event used to generate timestamps in log files
+  news            Messages relating to network news protocol (nntp)
+  ntp             Messages relating to network time protocol
+  syslog          Syslog service
+  user            Regular user processes
+  uucp            UUCP subsystem
+</file>
+==== Level (Severity) ====
+<file>
+emerg    Emergency condition, such as an imminent system crash, usually broadcast to all users
+alert    Condition that should be corrected immediately, such as a corrupted system database
+crit     Critical condition, such as a hardware error
+err      Ordinary error
+warning  Warning
+notice   Condition that is not an error, but possibly should be handled in a special way
+info     Informational message
+debug    Messages that are used when debugging programs
+  none     Pseudo level used to specify not to log messages.
+</file>
 ''debug, info, notice, warning, warn (same as warning), err, error (same as err), crit, alert, emerg,  panic  (same  as  emerg)''
 ((
 Testskript für Alles
-<file bash>for fac in auth authpriv cron daemon kern lpr mail mark news syslog user uucp local0 local1 local2 local3 local4 local5 local6 local7; do
+<file bash>for fac in auth authpriv cron daemon ftp kern lpr mail mark news syslog user uucp local0 local1 local2 local3 local4 local5 local6 local7; do
   for lev in debug info notice warning err crit alert emerg; do
     logger -p "${fac}.${lev}" "${fac}.${lev}"