ubuntu 16.04 设置syslog接收远程主机日志

Server:

首先,如果没有安装rsyslog,先要安装rsyslog(sudo apt-get install rsyslog), 确保监听日志发送端口

514, 编辑/etc/rsyslog.conf 文件如下:

# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

修改为:

# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

保存并重启服务service rsyslog restart

然后,以root身份修改rsyslog启动配置文件(Ubuntu在/etc/default/rsyslog下)

# Options to syslogd
# -m 0 disables 'MARK' messages.
# -r enables logging from remote machines
# -x disables DNS lookups on messages recieved with -r //禁用掉dns记录项不够齐全或其他的日志中心的日志
# See syslogd(8) for more details
# 
# -m 0 disables 'MARK' messages.
# -r enables logging from remote machines
# -x disables DNS lookups on messages recieved with -r //禁用掉dns记录项不够齐全或其他的日志中心的日志
# See syslogd(8) for more details
# 

SYSLOGD_OPTIONS="-r"  #SYSLOGD_OPTIONS="-r -x -m 180" ="-r"  #SYSLOGD_OPTIONS="-r -x -m 180" 

# 加 -r 选项以允许接受外来日志消息# 加 -x 禁用掉dns记录项不够齐全或其他的日志中心的日志# 加 -m 修改syslog的内部mark消息写入间隔时间（0为关闭）。例如-m 180，表示每隔180分钟（每天8次）在日志文件里增加一行时间戳消息# 加 -h 默认情况下，syslog不会发送从远端接受过来的消息到其他主机，而使用该选项，则把该开关打开，所有接受到的信息都可根据syslog.conf中定义的@主机转发过去。# Options to klogd# -2 prints all kernel oops messages twice; once for klogd to decode, and# once for processing with 'ksymoops'# -x disables all klogd processing of oops messages entirely# See klogd(8) for more detailsKLOGD_OPTIONS="-x"#SYSLOG_UMASK=077# set this to a umask value to use for all log files as in umask(1).# By default, all permissions are removed for "group" and "other".

完成服务端设置.

Client:

编辑 vi /etc/rsyslog.conf 文件如下:

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure
####这里设置发送的服务器地址
authpriv.*  @服务器IP
# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog
# Log cron stuff
cron.*                                                  /var/log/cron
# Everybody gets emergency messages
*.emerg                                                 *
# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler
# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log
# 写成这样就是把所有的信息都同步过去
*.* @服务器IP
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure
####这里设置发送的服务器地址
authpriv.*  @服务器IP
# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog
# Log cron stuff
cron.*                                                  /var/log/cron
# Everybody gets emergency messages
*.emerg                                                 *
# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler
# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log
# 写成这样就是把所有的信息都同步过去
*.* @服务器IP