So, I was having a discussion with a friend who has requested a few articles on systems monitoring. As many monitoring solutions utilize central logging, I thought I would start off with a good old fashioned Syslog server.
In this example, I use the below details
Syslog Server: syslog.example.com Client Server: server01.example.com
Setting up Syslog is really quite simple. Start by making sure you have the rsyslog package installed.
This will most likely already be the case, as local syslog is actually already used for local system logging.
[root@syslog ~]# yum install -y rsyslog
Next, we need to tell rsyslog to accept remote TCP and UDP syslog requests.
At the top of the file “/etc/rsyslog.conf”, at the top of the file, change the below lines
# Provides UDP syslog reception #$ModLoad imudp #$UDPServerRun 514 # Provides TCP syslog reception #$ModLoad imtcp #$InputTCPServerRun 514
# Provides UDP syslog reception $ModLoad imudp $UDPServerRun 514 # Provides TCP syslog reception $ModLoad imtcp $InputTCPServerRun 514
Once you have saved your changes, restart the rsyslog service
[root@syslog ~]# service rsyslog restart Shutting down system logger: [ OK ] Starting system logger: [ OK ] [root@syslog ~]#
Lastly, you’ll need to open the syslog ports on your local firewall.
[root@syslog ~]# iptables -I INPUT -p tcp --dport 514 -j ACCEPT [root@syslog ~]# iptables -I INPUT -p udp --dport 514 -j ACCEPT [root@syslog ~]# service iptables save iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ] [root@syslog ~]#
That’s it for the server side configuration. Now we need to point some clients to your new syslog server.
Firstly, make sure rsyslog is installed. Again, this should be part of your base install so you will see it is already installed.
[root@server01 ~]# yum install rsyslog
Next, we need to point our server to the new syslog installation
Edit “/etc/rsyslog.conf” and under the #### RULES #### section, add the below line to enable ALL syslog events to be sent to the remote server
Should you wish to, for example, only send mail logs to the syslog server, you would add the below line.
Once you save your changes, restart your rsyslog service
[root@server01 ~]# service rsyslog restart Shutting down system logger: [ OK ] Starting system logger: [ OK ] [root@server01 ~]#
As always, with any implementation, you should always test your changes to make sure it has worked.
To check your settings, tail all the logs on your syslog server as follows
[root@syslog ~]# tail -f /var/log/*
Next, you will need to trigger an event on your client system which will send its logs to Syslog.
For example, installing something via yum. For this purpose, I have run “yum install vsftpd”
You will see the below appear in the logs on your syslog server.
==> /var/log/messages <== Aug 18 19:15:25 server01 yum: Installed: vsftpd-2.2.2-11.el6.x86_64
If your logs have appeared, then you have configured your server and client correctly and remote logging is working successfully.
You will notice that your system’s hostname will appear in the remote logs. Here it is seen as “server01”. This will identify which logs are coming from which server.