Thursday, August 1, 2013

How to setup Syslog -Centralized log server in centos

How to setup Syslog -Centralized log server in centos.


Server Setup.

 [root@~]# vi /etc/sysconfig/syslog

# Options to syslogd
# -m 0 disables 'MARK' messages.
# -r enables logging from remote machines
# -x disables DNS lookups on messages recieved with -r
# See syslogd(8) for more details
SYSLOGD_OPTIONS="-r -m 0"   (ADD -r option )
# Options to klogd
# -2 prints all kernel oops messages twice; once for klogd to decode, and
#    once for processing with 'ksymoops'
# -x disables all klogd processing of oops messages entirely
# See klogd(8) for more details
KLOGD_OPTIONS="-x"
#
SYSLOG_UMASK=077
# set this to a umask value to use for all log files as in umask(1).
# By default, all permissions are removed for "group" and "other".

Restart services

[root@ ~]#  /etc/init.d/syslog restart
Shutting down kernel logger:                               [  OK  ]
Shutting down system logger:                               [  OK  ]
Starting system logger:                                    [  OK  ]
Starting kernel logger:                                    [  OK  ]
[root@ ~]# /etc/init.d/portmap restart
Stopping portmap:                                          [  OK  ]
Starting portmap:                                          [  OK  ]
[root@~]#  /etc/init.d/xinetd restart
Stopping xinetd:                                           [  OK  ]
Starting xinetd:                                           [  OK  ]
Check Syslog is listening on Port 514
[root@~]# netstat -ntulp |grep syslog
udp        0      0 0.0.0.0:514                 0.0.0.0:*                               1024/syslogd

Client Configuration.


[root@~]# vi /etc/syslog.conf 

*.* @172.16.111.152 (server Ip)
[root@ ~]#  /etc/init.d/syslog restart
Shutting down kernel logger:                               [  OK  ]
Shutting down system logger:                               [  OK  ]
Starting system logger:                                    [  OK  ]
Starting kernel logger:                                    [  OK  ]

To check the Syslog

 From Client 

[root@ ~]# logger hay

From Server

[root@ ~]# tail -f /var/log/messages
Aug  1 12:34:02-1 xinetd[2873]: EXIT: nrpe status=0 pid=22879 duration=0(sec)
Aug  1 12:34:30  sanoj: hay
Aug  1 12:34:32  xinetd[1054]: START: nrpe pid=1106 from=172.16.111.52
Aug  1 12:34:32[1054]: EXIT: nrpe status=0 pid=1106 duration=0(se

No comments:

Post a Comment