{"id":3832,"date":"2012-09-16T11:15:34","date_gmt":"2012-09-16T03:15:34","guid":{"rendered":"https:\/\/webhostinggeeks.com\/howto\/?p=3832"},"modified":"2023-04-28T09:48:59","modified_gmt":"2023-04-28T09:48:59","slug":"how-to-setup-central-log-server-using-rsyslog-on-centos-6-2centos6-3","status":"publish","type":"post","link":"https:\/\/webhostinggeeks.com\/howto\/how-to-setup-central-log-server-using-rsyslog-on-centos-6-2centos6-3\/","title":{"rendered":"How to Setup Central Log Server using Rsyslog on CentOS 6.2\/CentOS 6.3"},"content":{"rendered":"

\"\"In this post i will share on how to setup Central log server using Rsyslog on linux CentOS 6.2 and it’s also working on CentOS6.3. This rsyslog central server will archive all logging messages(\/var\/log\/messages) from it’s client. This logging messages might be helpful as these logs are very critical for system administrator for troubleshooting purpose.<\/p>\n

\/var\/log\/messages \u2013 Contains global system messages, including the messages that are logged during system startup. There are several things that are logged in \/var\/log\/messages including mail, cron, daemon, kern, auth, etc.<\/p>\n

Assumed that the central log server and client ip address are as below :<\/p>\n

Central rsyslog Server : 192.168.1.55(syslogserver)
\nRsyslog client : 192.168.1.54(rsyslogclient)<\/p>\n

Configure Central Rsyslog Server :<\/h2>\n

1. Login to Central Rsyslog Server. First we need to backup default rsyslog.conf configuration :<\/p>\n

\n[root@rsyslogserver ~]# cp \/etc\/rsyslog.conf \/etc\/rsyslog.conf.bak\n<\/pre>\n
2. Modify rsyslog configuration files :<\/p>\n
\n[root@rsyslogserver ~]# vi \/etc\/rsyslog.conf\n<\/pre>\n
3. Loads the modules we need :<\/p>\n
\n#### MODULES ####\n\n$ModLoad imuxsock.so    # provides support for local system logging (e.g. via logger command)\n$ModLoad imklog.so      # provides kernel logging support (previously done by rklogd)\n$ModLoad immark.so      # provides --MARK-- message capability\n\n<\/pre>\n
4. Listen on tcp and udp 514 :<\/p>\n
\n# Provides UDP syslog reception\n$ModLoad imudp.so\n$UDPServerAddress 0.0.0.0\n$UDPServerRun 514\n\n# Provides TCP syslog reception\n$ModLoad imtcp.so\n$InputTCPServerRun 514\n<\/pre>\n
5. Sets the default templates :<\/p>\n
\n# Use default timestamp format\n$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat\n<\/pre>\n
6. Implement logging rules :<\/p>\n
\n#### RULES ####\n\n# Log all kernel messages to the console.\n# Logging much else clutters up the screen.\n#kern.*                                                 \/dev\/console\n\n# Log anything (except mail) of level info or higher.\n# Don't log private authentication messages!\n*.info;mail.none;authpriv.none;cron.none                \/var\/log\/messages\n\n# The authpriv file has restricted access.\nauthpriv.*                                              \/var\/log\/secure\n\n# Log all the mail messages in one place.\nmail.*                                                  -\/var\/log\/maillog\n\n\n# Log cron stuff\ncron.*                                                  \/var\/log\/cron\n\n# Everybody gets emergency messages\n*.emerg                                                 *\n\n# Save news errors of level crit and higher in a special file.\nuucp,news.crit                                          \/var\/log\/spooler\n\n# Save boot messages also to boot.log\nlocal7.*                                                \/var\/log\/boot.log\n<\/pre>\n
7. Add the followings line in the forwarding rule :<\/p>\n
\n# ### begin forwarding rule ###\n..\n..\n#\n# This one is the template to generate the log filename dynamically, depending on the client's IP address.\n$template FILENAME,\"\/var\/log\/rsyslog\/%fromhost-ip%\/messages-%$YEAR%-%$MONTH%-%$DAY%.log\"\n#\n# Log all messages to the dynamically formed file. Now each clients log (192.168.1.2, 192.168.1.3,etc...), will be under a separate directory which is formed by the template FILENAME.\n*.* ?FILENAME\n..\n..\n# ### end of the forwarding rule ###\n<\/pre>\n
8. Create rsyslog folder under \/var\/log :<\/p>\n
\n[root@rsyslogserver ~]# mkdir \/var\/log\/rsyslog\n<\/pre>\n
9. After adding the above lines to the rsyslog.conf, you need to restart the rsyslog process and it’s will ready to accept messages from configured client :<\/p>\n
\n[root@rsyslogserver ~]# service rsyslog restart\nShutting down system logger:                               [  OK  ]\nStarting system logger:                                    [  OK  ]\n<\/pre>\n
Configure Rsyslog Remote Client :<\/h2>\n
1. Login to individual client machines and set the following :<\/p>\n
\n[root@rsyslogclient ~]# vim \/etc\/rsyslog.conf\n<\/pre>\n
2. Loads the modules we need :<\/p>\n
\n#### MODULES ####\n\n$ModLoad imuxsock.so    # provides support for local system logging (e.g. via logger command)\n$ModLoad imklog.so      # provides kernel logging support (previously done by rklogd)\n$ModLoad immark.so      # provides --MARK-- message capability\n<\/pre>\n
3. Enable “*.*  @192.168.1.55:514<\/strong>” at the forwarding rule :<\/p>\n
\n# ### begin forwarding rule ###\n# The statement between the begin ... end define a SINGLE forwarding\n# rule. They belong together, do NOT split them. If you create multiple\n# forwarding rules, duplicate the whole block!\n# Remote Logging (we use TCP for reliable delivery)\n#\n# An on-disk queue is created for this action. If the remote host is\n# down, messages are spooled to disk and sent when it is up again.\n#$WorkDirectory \/var\/lib\/rsyslog # where to place spool files\n#$ActionQueueFileName fwdRule1 # unique name prefix for spool files\n#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)\n#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown\n#$ActionQueueType LinkedList   # run asynchronously\n#$ActionResumeRetryCount -1    # infinite retries if host is down\n# remote host is: name\/ip:port, e.g. 192.168.0.1:514, port optional\n*.*  @192.168.1.55:514\n# ### end of the forwarding rule ###\n#\n<\/pre>\n
4. Restart the rsyslog service on the client :<\/p>\n
\n[root@rsyslogclient ~]# service rsyslog restart\nShutting down system logger:                               [  OK  ]\nStarting system logger:                                    [  OK  ]\n<\/pre>\n
Verification :<\/h2>\n
Login and verify the log files from central rsyslog server, rsyslogserver :<\/p>\n
\n[root@rsyslogserver ~]# ls \/var\/log\/rsyslog\/192.168.1.54\/\nmessages-2012-09-16.log\n<\/pre>\n
Check the log :<\/p>\n
\n[root@rsyslogserver ~]# tail -f \/var\/log\/rsyslog\/192.168.1.54\/messages-2012-09-16.log\nSep 16 11:45:48 rsyslogclient ntpd[1359]: synchronized to 212.26.18.43, stratum 1\nSep 16 11:46:34 rsyslogclient clamd[1367]: SelfCheck: Database status OK.\nSep 16 11:53:47 rsyslogclient ntpd[1359]: time reset +2.330541 s\nSep 16 11:56:36 rsyslogclient clamd[1367]: SelfCheck: Database status OK.\nSep 16 11:58:32 rsyslogclient ntpd[1359]: synchronized to 212.26.18.43, stratum 1\nSep 16 12:01:01 rsyslogclient CROND[11208]: (root) CMD (run-parts \/etc\/cron.hourly)\nSep 16 12:01:01 rsyslogclient run-parts(\/etc\/cron.hourly)[1120 starting 00awstats\nSep 16 12:01:01 rsyslogclient run-parts(\/etc\/cron.hourly)[1121 finished 00awstats\nSep 16 12:01:01 rsyslogclient run-parts(\/etc\/cron.hourly)[1120 starting 0anacron\nSep 16 12:01:01 rsyslogclient run-parts(\/etc\/cron.hourly)[1122 finished 0anacron\nSep 16 12:06:36 rsyslogclient clamd[1367]: SelfCheck: Database status OK.\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
In this post i will share on how to setup Central log server using Rsyslog on linux CentOS 6.2 and it’s also working on CentOS6.3. This rsyslog central server will…<\/p>\n","protected":false},"author":6,"featured_media":3845,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"wds_primary_category":0,"footnotes":""},"categories":[1000],"tags":[1536],"class_list":["post-3832","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-logging","tag-linux"],"_links":{"self":[{"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/posts\/3832","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/comments?post=3832"}],"version-history":[{"count":0,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/posts\/3832\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/media\/3845"}],"wp:attachment":[{"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/media?parent=3832"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/categories?post=3832"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webhostinggeeks.com\/howto\/wp-json\/wp\/v2\/tags?post=3832"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}