Benutzer-Werkzeuge
admin_grundlagen:syslog
Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen gezeigt.
| Beide Seiten, vorherige Überarbeitung Vorherige Überarbeitung Nächste Überarbeitung | Vorherige Überarbeitung | ||
|
admin_grundlagen:syslog [2015/05/08 08:18] carsten_strotmann |
admin_grundlagen:syslog [2025/04/04 07:43] (aktuell) ingo_wichmann [Zielrechner:] |
||
|---|---|---|---|
| Zeile 1: | Zeile 1: | ||
| - | ====== syslog ====== | ||
| - | Beispiel: Logdaten von einem Rechner auf den nächsten übertragen | ||
| - | |||
| - | ===== Zielrechner: ===== | ||
| - | Zielrechner netzwerkfähig machen: | ||
| - | |||
| - | ''/etc/sysconfig/syslog'' : ( Centos 5 ) | ||
| - | <file> | ||
| - | SYSLOGD_OPTIONS="-m 0 -r" | ||
| - | </file> | ||
| - | |||
| - | ''/etc/sysconfig/syslog'': ( openSuSE 11.1 ) | ||
| - | <code bash> | ||
| - | SYSLOGD_PARAMS="-r" | ||
| - | </code> | ||
| - | |||
| - | ''/etc/default/syslogd'': ( debian 4.0 ) | ||
| - | <code bash> | ||
| - | SYSLOGD="-r" | ||
| - | </code> | ||
| - | |||
| - | Passende Nachrichten in Datei '/var/log/beispiel' schreiben: | ||
| - | |||
| - | ''/etc/syslog.conf'' : | ||
| - | <file> | ||
| - | local5.info -/var/log/beispiel | ||
| - | </file> | ||
| - | |||
| - | Syslog neu starten: | ||
| - | /etc/init.d/sysklogd restart | ||
| - | |||
| - | ===== Absender-Rechner: ===== | ||
| - | /etc/syslog.conf: | ||
| - | local5.info @zielrechner | ||
| - | |||
| - | Syslog neu einlesen: | ||
| - | /etc/init.d/sysklogd restart | ||
| - | |||
| - | Testen: Meldung abschicken: | ||
| - | logger -p local5.info "Testmeldung" | ||
| - | |||
| ====== rsyslog ====== | ====== rsyslog ====== | ||
| Beispiel: Logdaten von einem Rechner auf den nächsten übertragen | Beispiel: Logdaten von einem Rechner auf den nächsten übertragen | ||
| Zeile 46: | Zeile 5: | ||
| Passende Nachrichten in Datei ''/var/log/beispiel'' schreiben: | Passende Nachrichten in Datei ''/var/log/beispiel'' schreiben: | ||
| - | === Debian, CentOS === | + | === Debian, CentOS, Ubuntu === |
| - | ''/etc/rsyslog.conf'': ( debian 5.0, centos 6.0 ) | + | ''/etc/rsyslog.d/10-remote.conf'': ( debian 5.0, centos 6.0, ubuntu 18.04 ) |
| <file> | <file> | ||
| - | $ModLoad imudp | + | $ModLoad imudp |
| - | $UDPServerRun 514 | + | $UDPServerRun 514 |
| - | local5.info -/var/log/beispiel | + | $template RemoteHost,"/var/log/remote/%HOSTNAME%.log" |
| + | |||
| + | local5.info ?RemoteHost | ||
| </file> | </file> | ||
| Zeile 62: | Zeile 23: | ||
| === SuSE === | === SuSE === | ||
| - | ''/etc/rsyslog.d/remote.conf'': ( sles 11 SP 1 ) | + | ''/etc/rsyslog.d/remote.conf'': ( openSuSE Leap 15.6 ) |
| <file> | <file> | ||
| - | $ModLoad imudp | + | # ######### Receiving Messages from Remote Hosts ########## |
| - | $UDPServerRun 514 | + | # TCP Syslog Server: |
| - | </file> | + | # provides TCP syslog reception and GSS-API (if compiled to support it) |
| - | ''/etc/rsyslog.conf'': ( debian 5.0 ) | + | # see https://www.rsyslog.com/receiving-messages-from-a-remote-system |
| + | module(load="imtcp") | ||
| + | input(type="imtcp" port="514" Address="0.0.0.0") | ||
| - | <file> | + | # UDP Syslog Server: |
| - | local5.info -/var/log/beispiel | + | module(load="imudp") |
| + | input(type="imudp" port="514" Address="0.0.0.0") | ||
| </file> | </file> | ||
| + | |||
| + | Syntax der Konfigurationsdatei überprüfen:((http://www.rsyslog.com/how-can-i-check-the-config/ )) | ||
| + | |||
| + | rsyslogd -N1 | ||
| Syslog neu starten: | Syslog neu starten: | ||
| - | /etc/init.d/syslog restart | + | |
| + | systemctl restart syslog | ||
| ===== Absender-Rechner: ===== | ===== Absender-Rechner: ===== | ||
| Zeile 83: | Zeile 52: | ||
| Syslog neu einlesen: | Syslog neu einlesen: | ||
| - | /etc/init.d/rsyslog restart | + | service rsyslog restart |
| Testen: Meldung abschicken: | Testen: Meldung abschicken: | ||
| logger -p local5.info "Testmeldung" | logger -p local5.info "Testmeldung" | ||
| + | | ||
| + | Über's Netz direkt an syslog-Server: | ||
| + | logger -p local5.info -n notebook03 --tcp --port 514 "tcp test" | ||
| + | |||
| + | ===== property based filter ===== | ||
| + | Auf dem Zielrechner: | ||
| + | <file /etc/rsyslog.d/45-remote-filter.conf> | ||
| + | |||
| + | :syslogtag, isequal, "ingo:" /var/log/ingo.log | ||
| + | & ~ # in der vorherigen Zeile ausgegebene Meldungen nicht erneut ausgeben | ||
| + | :source , !isequal , "notebook02" ~ | ||
| + | </file> | ||
| + | |||
| + | |||
| + | |||
| ====== syslog-ng ====== | ====== syslog-ng ====== | ||
| Zeile 174: | Zeile 158: | ||
| ====== Doku ====== | ====== Doku ====== | ||
| - | * Facility: | + | Jede Logmeldung besitzt eine __priority__\\ |
| + | die sich zusammensetzt aus einer __facility__ und einem __level__:\\ | ||
| + | prio=fac.level | ||
| + | ==== Facility ==== | ||
| Nicht jedes Linux/Unix hat alle Facilities: | Nicht jedes Linux/Unix hat alle Facilities: | ||
| <file> | <file> | ||
| Zeile 198: | Zeile 184: | ||
| </file> | </file> | ||
| - | * Level (Severity): | + | ==== Level (Severity) ==== |
| <file> | <file> | ||
| - | emerg Emergency condition, such as an imminent system crash, usually broadcast to all users | + | 0 emerg Emergency condition, such as an imminent system crash, usually broadcast to all users |
| - | alert Condition that should be corrected immediately, such as a corrupted system database | + | 1 alert Condition that should be corrected immediately, such as a corrupted system database |
| - | crit Critical condition, such as a hardware error | + | 2 crit Critical condition, such as a hardware error |
| - | err Ordinary error | + | 3 err Ordinary error |
| - | warning Warning | + | 4 warning Warning |
| - | notice Condition that is not an error, but possibly should be handled in a special way | + | 5 notice Condition that is not an error, but possibly should be handled in a special way |
| - | info Informational message | + | 6 info Informational message |
| - | debug Messages that are used when debugging programs | + | 7 debug Messages that are used when debugging programs |
| - | none Pseudo level used to specify not to log messages. | + | none Pseudo level used to specify not to log messages. |
| </file> | </file> | ||
| ''debug, info, notice, warning, warn (same as warning), err, error (same as err), crit, alert, emerg, panic (same as emerg)'' | ''debug, info, notice, warning, warn (same as warning), err, error (same as err), crit, alert, emerg, panic (same as emerg)'' | ||
admin_grundlagen/syslog.1431073095.txt.gz · Zuletzt geändert: 2015/05/08 08:18 von carsten_strotmann
Seiten-Werkzeuge
Falls nicht anders bezeichnet, ist der Inhalt dieses Wikis unter der folgenden Lizenz veröffentlicht: CC Attribution-Noncommercial-Share Alike 4.0 International
