Rsyslog: Difference between revisions
→Syslog Client
| (6 intermediate revisions by the same user not shown) | |||
Line 32:
= Syslog Client =
*On the Client Machine:
sudo nano /etc/rsyslog.d/50-default.conf
*Add the following line at the top of the file before the '''log by facility''' section, :
/etc/rsyslog.d/50-default.conf
*.* @10.107.88.93:514
Restart rsyslog service▼
*In case you want only certain syslog alerts to be logged to remote server:
auth,authpriv.* @10.107.88.93:514
*Settings for when Rsyslog Server would be down:
$ActionQueueFileName queue
$ActionQueueMaxDiskSpace 1g
$ActionQueueSaveOnShutdown on
$ActionQueueType LinkedList
$ActionResumeRetryCount -1
▲*Restart rsyslog service
sudo service rsyslog restart
Line 48 ⟶ 60:
logger -p local4.info "This is a info message from local 4"
= Generate Syslog messages =
*Test UDP syslog messages on port 514 with the following command:
echo "<14>Test UDP syslog message" >> /dev/udp/<target_hostname_or_ip_address>/514
*Test TCP syslog messages on port 514 with the following command:
echo "<14>Test TCP syslog message" >> /dev/tcp/<target_hostname_or_ip_address>/514
<br />
| |||