RHEL as syslog server


syslog-ng express installation

1.stop syslog
  /etc/init.d/syslog stop
  chkconfig --level 2345 syslog off

2.install eventlog-0.2.5-6
  ftp://ftp.pbone.net/mirror/centos.karan.org/el5/extras/testing/i386/RPMS/eventlog-0.2.5-6.el5.kb.i386.rpm
  # rpm -ivh eventlog-0.2.5-6.el5.kb.i386.rpm

3.install syslog-ng-2.1.3-2
  ftp://ftp.pbone.net/mirror/ftp.silfreed.net/repo/rhel/5/i386/silfreednet/RPMS/syslog-ng-2.1.3-2.el5.i386.rpm
  # rpm -ivh syslog-ng-2.1.3-2.el5.i386.rpm

4.You will need to edit the syslog configuration under /etc/syslog-ng/syslog-ng.conf and you will need to add three entries. The first addition is to configure the source for log messages from the network and enabling both udp/tcp on port 514, you may add the following under the default "src" entry.


source network {
udp6( port(514) );
tcp6( port(514) );
};


the next two entries will define the destination and how it'll log. You will add the following at the end of the syslog-ng.conf configuration file.

destination log_remote {
file("/var/log/remote/$HOST_FROM/$YEAR-$MONTH/messages-$YEAR-$MONTH-$DAY"
create_dirs(yes) frac-digits(3)
template("$ISODATE $PROGRAM $MSGONLY\n")
template_escape(no)
);
};

log {
source(network);
destination(log_remote);
};

The "log_remote" destination will send all logs from your ESX(i) hosts into/var/log/remote and will have the following format: $HOST_FROM/$YEAR-$MONTH/messages-$YEAR-$MONTH-$DAY

5. restart syslog-ng service 

6. config esxi syslog destination



留言

這個網誌中的熱門文章

Install vSphere 4.1 Update Management display "ODBC 32bit"

How to install open VM tools on Ubuntu 14.04

How to build PrivacyIdea HA with MySQL with master and master replication