RHEL as syslog server
syslog-ng express installation
1.stop syslog
/etc/init.d/syslog stop
chkconfig --level 2345 syslog off
2.install eventlog-0.2.5-6
ftp://ftp.pbone.net/mirror/centos.karan.org/el5/extras/testing/i386/RPMS/eventlog-0.2.5-6.el5.kb.i386.rpm
# rpm -ivh eventlog-0.2.5-6.el5.kb.i386.rpm
3.install syslog-ng-2.1.3-2
ftp://ftp.pbone.net/mirror/ftp.silfreed.net/repo/rhel/5/i386/silfreednet/RPMS/syslog-ng-2.1.3-2.el5.i386.rpm
# rpm -ivh syslog-ng-2.1.3-2.el5.i386.rpm
4.You will need to edit the syslog configuration under /etc/syslog-ng/syslog-ng.conf and you will need to add three entries. The first addition is to configure the source for log messages from the network and enabling both udp/tcp on port 514, you may add the following under the default "src" entry.
source network {
udp6( port(514) );
tcp6( port(514) );
};
the next two entries will define the destination and how it'll log. You will add the following at the end of the syslog-ng.conf configuration file.
destination log_remote {
file("/var/log/remote/$HOST_FROM/$YEAR-$MONTH/messages-$YEAR-$MONTH-$DAY"
create_dirs(yes) frac-digits(3)
template("$ISODATE $PROGRAM $MSGONLY\n")
template_escape(no)
);
};
log {
source(network);
destination(log_remote);
};
The "log_remote" destination will send all logs from your ESX(i) hosts into/var/log/remote and will have the following format: $HOST_FROM/$YEAR-$MONTH/messages-$YEAR-$MONTH-$DAY
5. restart syslog-ng service
6. config esxi syslog destination
留言