SONTAYA'P BLOGGER

IT Digital lifestyle

Centralized logging with syslog

bySONTAYA July 13, 2013 Linux

จดบันทึกโดยการอ้างอิจแบบสั้นๆ เข้าใจง่ายดี สำหรับขั้นตอนการติดตั้งและนำมาใช้งาน Centralized Log Server | PHP-Syslog-NG | Syslog-ng-SSH log

####################################
# SYSLOG NOTES BY Mark E. Donaldson
####################################
# SYSLOG STARTUP OPTIONS
####################################

-r flag used to accept messages from remote machines
-h flag allows syslog to send messages to a remote machine

#############################
# SYSLOG.CONF FILE
#############################
Syntax: selector <TAB> action
selector = facility.level
action = where to log

Facilities (Programs):
● kern
● user (default)
● mail
● daemon
● auth
● lpr
● news
● uucp
● cron
● mark
● local0-7
● syslog
● authpriv
● ftp
● * (all or any) & none

Levels (Severity):
● emerg
● alert
● crit
● err
● warning
● notice
● info
● debug
● * (all or any) & none

Actions:
● filename
● @hostname
● @ipaddress
● user1
● *
● – symbol in front of file means synchronization & buffering

Examples:
# Enable remote logging
*.* @192.168.0.3
*.* @server4.bandwidthco.com

# enable this, if you want that root is informed
*.alert root

# all email-messages in one file
mail.* /var/log/mail

# email in separate files
mail.info /var/log/mail.info
mail.warn /var/log/mail.warn
mail.err /var/log/mail.err
# Warnings in one file
*.=warn;*.=err /var/log/warn
*.crit /var/log/warn
# save the rest in one file
*.*;mail.none;news.none /var/log/messages
*.* /var/log/allmessages

###########################
# LOGGER COMMAND
###########################
Syntax: logger –p facility.level –t tag message | file filename

-p option = facility and severity level
-t option = identifying tag in message
-I option = include process ID in message

Example:
logger –I –p local1.err –t FFT “Job Failed – scratch disk full”
##########################################
# Syslog Notes By Peter Matulis CANONICAL@
##########################################
Facilities:
Numerical Code Keyword Facility
0 kern Kernel
1 user Regular user processess
2 mail Mail system
3 daemon System daemons
4 auth Security (authentication and authorisation) related commands
5 syslog Syslog internal messages
6 lpr Line printers system
7 news NNTP subsystem
8 uucp UUCP subsystem
10 authpriv Private authorisation messages
16-23 local0-7 Site specific use

Priorities:
Numerical Code Keyword Facility
0 emerg Emergency: system is unusable
1 alert Alert: action must be taken immediately
2 crit Critical: critical conditions
3 err Error: error conditions
4 warning Warning: warning conditions
5 notice Notice: normal but significant conditions
6 info Informational: informational messages
7 debug Debug: debug level messages

Note : Numerical codes should not be used in syslog.conf on Linux systems. Should you need to configure a non-Linux syslog deamon which uses numerical codes only
e.g. Cisco Router, to send syslog messages to your log server.

Logging software:
The rsyslog tool was chosen over the more popular syslog-ng for the following reasons:

1. Licensing and software features
Syslog-ng is dual-licensed. A commercial product has been forked from the open-
source (GPL) project and the more advanced features are found only in the
commercial offering. Affected features of import so far are i) native TLS/SSL support
(i.e. not using stunnel) and ii) on-disk spooling of messages. It’s unknown how these
forks will diverge in the future.

2. Truly reliable message delivery (RELP)
Rsyslog is confronting the unreliability of TCP in a logging environment through the
development of the RELP protocol whereas syslog-ng is not.

3. Compliance with IETF regarding reliable TCP transport (RFC 3195)
Rsyslog is compliant with the standards regarding reliable TCP transport whereas
syslog-ng is not.

4. Native support for traffic encryption (TLS/SSL)
Rsyslog supports TLS natively whereas the GPL fork of syslog-ng does not.

5. SNMP support
Rsyslog supports SNMP traps whereas syslog-ng does not.

6. BSD-style hostname and program name blocks
Rsyslog supports powerful BSD-style hostname and program name blocks for easy
multi-host implementations whereas syslog-ng does not.

7. On-disk message spooling
Rsyslog has on-disk file spooling features that are lacking in GPL syslog-ng:
● on-demand (as needed) spooling
● independent spool files per log action
● spool files on multiple disks
● Process spooled messages during configured timeframes

8. Include config files
Rsyslog has configuration include file support that syslog-ng lacks. This allows one to
organize and split one’s configuration into multiple files.

9. Native support for email alerts
Rsyslog natively supports the ability to send email alerts based on log message
content. Syslog-ng needs to pipe data to an external process.

Logging models:

1. Single system (to disk)
Individual computer systems, by default, perform logging. Messages typically get written to the
local hard drive but Network Attached Storage (NAS) or Storage Area Network (SAN) are also
valid storage options for this model.

Single system (to disk)
Single system (to disk)

2. Multiple systems (to disk)
Known as central logging, many systems forward their logs over the network to a central logging
server. Analogous to the single-system model, on the server-side, messages get written to the
local hard drive or to some other available storage.

Multiple systems (to disk)
Multiple systems (to disk)

3. Multiple systems (to database)
A common option is to have the remote messages stored directly into a database on the server
with, possibly, a web-based interface acting as a viewing/query tool.
The database need not reside on the logging server (as shown in the diagram); it can be placed
onto a separate system.

Multiple systems (to database)
Multiple systems (to database)
TaggedSyslog

Google Drive สคริปต์ Copy Folder From Template

Google Drive และข้อจำกัดการอัพโหลดไฟล์

Leave a Reply Cancel reply

You must be logged in to post a comment.

Tag Cloud

3G Android Backup Blognone Chromecast Cloud Comparison CUPS Dell DNS Facebook Firefox Firewall Google Guitar Hacked HP Joomla LGP500 LibreOffice Linux Mozilla Firefox OpenOffice.org Open Source OpenStack openSUSE openSUSE11.3 openSUSE12.1 Peplink Performance Postfix Printer Samsung Security Storage SUSE SUSE Enterprise Desktop SUSE Enterprise Server SUSE Linux Enterprise Switch Thin client Tips VMware WordPress WordPress/SMF

Comments

  • Narupon Pattapat on การ cleaning the imaging unit หรือ Drum (Imaging Unit)
  • 76Rusty on แอพ aVia Media Player Pro และ Pocket Casts 4 อนาคตอาจรองรับ Chromecast
  • JindaTheme on CloudFlare คืออะไร?
  • viva3388 on CloudFlare คืออะไร?
  • SONTAYA on Linux Foundation T-Shirt มาแล้ว

Categories

  • Android (7)
  • Joomla (9)
  • LibreOffice/OpenOffice.org (16)
  • Linux (159)
  • Music (16)
  • News (55)
  • Office (55)
  • Online Marketing (3)
  • Personal (232)
  • VMware (5)
  • WordPress/SMF (20)

Archives

  • May 2019
  • March 2019
  • January 2019
  • December 2018
  • September 2018
  • August 2018
  • July 2018
  • April 2018
  • March 2018
  • January 2018
  • December 2017
  • June 2017
  • December 2016
  • November 2016
  • April 2016
  • March 2016
  • February 2016
  • September 2015
  • August 2015
  • July 2015
  • June 2015
  • May 2015
  • April 2015
  • February 2015
  • January 2015
  • November 2014
  • October 2014
  • September 2014
  • August 2014
  • July 2014
  • June 2014
  • May 2014
  • April 2014
  • March 2014
  • February 2014
  • December 2013
  • November 2013
  • October 2013
  • September 2013
  • August 2013
  • July 2013
  • June 2013
  • May 2013
  • April 2013
  • March 2013
  • February 2013
  • January 2013
  • December 2012
  • November 2012
  • October 2012
  • September 2012
  • August 2012
  • June 2012
  • May 2012
  • April 2012
  • March 2012
  • February 2012
  • December 2011
  • November 2011
  • October 2011
  • September 2011
  • August 2011
  • July 2011
  • June 2011
  • May 2011
  • April 2011
  • March 2011
  • February 2011
  • January 2011
  • December 2010
  • November 2010
  • October 2010
  • September 2010
  • August 2010
  • July 2010
  • June 2010
  • May 2010
  • April 2010
  • March 2010
  • February 2010
  • January 2010
  • December 2009

Archives

  • May 2019 (1)
  • March 2019 (1)
  • January 2019 (1)
  • December 2018 (1)
  • September 2018 (1)
  • August 2018 (3)
  • July 2018 (1)
  • April 2018 (1)
  • March 2018 (1)
  • January 2018 (2)
  • December 2017 (1)
  • June 2017 (3)
  • December 2016 (1)
  • November 2016 (1)
  • April 2016 (1)
  • March 2016 (2)
  • February 2016 (1)
  • September 2015 (3)
  • August 2015 (2)
  • July 2015 (7)
  • June 2015 (5)
  • May 2015 (1)
  • April 2015 (1)
  • February 2015 (2)
  • January 2015 (1)
  • November 2014 (3)
  • October 2014 (2)
  • September 2014 (2)
  • August 2014 (1)
  • July 2014 (3)
  • June 2014 (3)
  • May 2014 (2)
  • April 2014 (5)
  • March 2014 (2)
  • February 2014 (5)
  • December 2013 (3)
  • November 2013 (15)
  • October 2013 (15)
  • September 2013 (11)
  • August 2013 (9)
  • July 2013 (26)
  • June 2013 (7)
  • May 2013 (15)
  • April 2013 (6)
  • March 2013 (5)
  • February 2013 (4)
  • January 2013 (2)
  • December 2012 (9)
  • November 2012 (2)
  • October 2012 (4)
  • September 2012 (2)
  • August 2012 (4)
  • June 2012 (3)
  • May 2012 (4)
  • April 2012 (6)
  • March 2012 (14)
  • February 2012 (9)
  • December 2011 (8)
  • November 2011 (6)
  • October 2011 (13)
  • September 2011 (7)
  • August 2011 (10)
  • July 2011 (4)
  • June 2011 (12)
  • May 2011 (26)
  • April 2011 (6)
  • March 2011 (3)
  • February 2011 (4)
  • January 2011 (10)
  • December 2010 (6)
  • November 2010 (4)
  • October 2010 (5)
  • September 2010 (10)
  • August 2010 (5)
  • July 2010 (8)
  • June 2010 (6)
  • May 2010 (4)
  • April 2010 (9)
  • March 2010 (10)
  • February 2010 (8)
  • January 2010 (21)
  • December 2009 (28)
Proudly powered by WordPress | Theme: Showme by NEThemes.