Top-Themen

AppleEntwicklungHardwareInternetLinuxMicrosoftMultimediaNetzwerkeOff TopicSicherheitSonstige SystemeVirtualisierungWeiterbildungZusammenarbeit

Aktuelle Themen (A bis Z)

Administrator.de FeedbackApache ServerAppleAssemblerAudioAusbildungAuslandBackupBasicBatch & ShellBenchmarksBibliotheken & ToolkitsBlogsCloud-DiensteClusterCMSCPU, RAM, MainboardsCSSC und C++DatenbankenDatenschutzDebianDigitiales FernsehenDNSDrucker und ScannerDSL, VDSLE-BooksE-BusinessE-MailEntwicklungErkennung und -AbwehrExchange ServerFestplatten, SSD, RaidFirewallFlatratesGoogle AndroidGrafikGrafikkarten & MonitoreGroupwareHardwareHosting & HousingHTMLHumor (lol)Hyper-VIconsIDE & EditorenInformationsdiensteInstallationInstant MessagingInternetInternet DomäneniOSISDN & AnaloganschlüsseiTunesJavaJavaScriptKiXtartKVMLAN, WAN, WirelessLinuxLinux DesktopLinux NetzwerkLinux ToolsLinux UserverwaltungLizenzierungMac OS XMicrosoftMicrosoft OfficeMikroTik RouterOSMonitoringMultimediaMultimedia & ZubehörNetzwerkeNetzwerkgrundlagenNetzwerkmanagementNetzwerkprotokolleNotebook & ZubehörNovell NetwareOff TopicOpenOffice, LibreOfficeOutlook & MailPapierkorbPascal und DelphiPeripheriegerätePerlPHPPythonRechtliche FragenRedHat, CentOS, FedoraRouter & RoutingSambaSAN, NAS, DASSchriftartenSchulung & TrainingSEOServerServer-HardwareSicherheitSicherheits-ToolsSicherheitsgrundlagenSolarisSonstige SystemeSoziale NetzwerkeSpeicherkartenStudentenjobs & PraktikumSuche ProjektpartnerSuseSwitche und HubsTipps & TricksTK-Netze & GeräteUbuntuUMTS, EDGE & GPRSUtilitiesVB for ApplicationsVerschlüsselung & ZertifikateVideo & StreamingViren und TrojanerVirtualisierungVisual StudioVmwareVoice over IPWebbrowserWebentwicklungWeiterbildungWindows 7Windows 8Windows 10Windows InstallationWindows MobileWindows NetzwerkWindows ServerWindows SystemdateienWindows ToolsWindows UpdateWindows UserverwaltungWindows VistaWindows XPXenserverXMLZusammenarbeit

Syslog-Ng Konfiguration

Frage Linux Linux Netzwerk

Mitglied: tamti

tamti (Level 1) - Jetzt verbinden

06.12.2006, aktualisiert 02.11.2016, 6577 Aufrufe, 1 Kommentar

Hallo zusammen,

also ich bin ein Fachinformatiker Azubi (Fisi erstes Jahr) und habe jetzt eine Aufgabe zum Syslog-Ng bekommen.
Ich soll den so konfigurieren dass er Logdateien von verschiedenen Switches sammelt und jeweils seperat zur jeder Switch speichert.

Leider weiß ich nicht so recht wie ich die "syslog-ng.conf" umschreiben muss damit es glatt funktioniert.

Würde mich freuen wenn mir das jemand kurz erläutern könnte wie man das am besten macht oder den einen oder anderen Nützlichen Link postet welches das schön erklärt.

Bis dann THX

tamti

so sieht die jetzige conf Datei aus.
01.
02.
# Configuration file for syslog-ng under Debian 
03.
04.
# attempts at reproducing default syslog behavior 
05.
 
06.
# the standard syslog levels are (in descending order of priority): 
07.
# emerg alert crit err warning notice info debug 
08.
# the aliases "error", "panic", and "warn" are deprecated 
09.
# the "none" priority found in the original syslogd configuration is 
10.
# only used in internal messages created by syslogd 
11.
 
12.
 
13.
###### 
14.
# options 
15.
 
16.
options { 
17.
        # disable the chained hostname format in logs 
18.
        # (default is enabled) 
19.
        chain_hostnames(0); 
20.
 
21.
        # the time to wait before a died connection is re-established 
22.
        # (default is 60) 
23.
        time_reopen(10); 
24.
 
25.
        # the time to wait before an idle destination file is closed 
26.
        # (default is 60) 
27.
        time_reap(360); 
28.
 
29.
        # the number of lines buffered before written to file 
30.
        # you might want to increase this if your disk isn't catching with 
31.
        # all the log messages you get or if you want less disk activity 
32.
        # (say on a laptop) 
33.
        # (default is 0) 
34.
        #sync(0); 
35.
 
36.
        # the number of lines fitting in the output queue 
37.
        log_fifo_size(2048); 
38.
 
39.
        # enable or disable directory creation for destination files 
40.
        create_dirs(yes); 
41.
 
42.
        # default owner, group, and permissions for log files 
43.
        # (defaults are 0, 0, 0600) 
44.
        #owner(root); 
45.
        group(adm); 
46.
        perm(0640); 
47.
 
48.
        # default owner, group, and permissions for created directories 
49.
        # (defaults are 0, 0, 0700) 
50.
        #dir_owner(root); 
51.
        #dir_group(root); 
52.
        dir_perm(0755); 
53.
 
54.
        # enable or disable DNS usage 
55.
        # syslog-ng blocks on DNS queries, so enabling DNS may lead to 
56.
        # a Denial of Service attack 
57.
        # (default is yes) 
58.
        use_dns(no); 
59.
 
60.
        # maximum length of message in bytes 
61.
        # this is only limited by the program listening on the /dev/log Unix 
62.
        # socket, glibc can handle arbitrary length log messages, but -- for 
63.
        # example -- syslogd accepts only 1024 bytes 
64.
        # (default is 2048) 
65.
        #log_msg_size(2048); 
66.
}; 
67.
 
68.
 
69.
###### 
70.
# sources 
71.
 
72.
# all known message sources 
73.
source s_all { 
74.
        # message generated by Syslog-NG 
75.
        internal(); 
76.
        # standard Linux log source (this is the default place for the syslog() 
77.
        # function to send logs to) 
78.
        unix-stream("/dev/log"); 
79.
        # messages from the kernel 
80.
        file("/proc/kmsg" log_prefix("kernel: ")); 
81.
        # use the above line if you want to receive remote UDP logging messages 
82.
        # (this is equivalent to the "-r" syslogd flag) 
83.
        # udp(); 
84.
}; 
85.
 
86.
 
87.
###### 
88.
# destinations 
89.
 
90.
# some standard log files 
91.
destination df_auth { file("/var/log/auth.log"); }; 
92.
destination df_syslog { file("/var/log/syslog"); }; 
93.
destination df_cron { file("/var/log/cron.log"); }; 
94.
destination df_daemon { file("/var/log/daemon.log"); }; 
95.
destination df_kern { file("/var/log/kern.log"); }; 
96.
destination df_lpr { file("/var/log/lpr.log"); }; 
97.
destination df_mail { file("/var/log/mail.log"); }; 
98.
destination df_user { file("/var/log/user.log"); }; 
99.
destination df_uucp { file("/var/log/uucp.log"); }; 
100.
 
101.
# these files are meant for the mail system log files 
102.
# and provide re-usable destinations for {mail,cron,...}.info, 
103.
# {mail,cron,...}.notice, etc. 
104.
destination df_facility_dot_info { file("/var/log/$FACILITY.info"); }; 
105.
destination df_facility_dot_notice { file("/var/log/$FACILITY.notice"); }; 
106.
destination df_facility_dot_warn { file("/var/log/$FACILITY.warn"); }; 
107.
destination df_facility_dot_err { file("/var/log/$FACILITY.err"); }; 
108.
destination df_facility_dot_crit { file("/var/log/$FACILITY.crit"); }; 
109.
 
110.
# these files are meant for the news system, and are kept separated 
111.
# because they should be owned by "news" instead of "root" 
112.
destination df_news_dot_notice { file("/var/log/news/news.notice" owner("news")); }; 
113.
destination df_news_dot_err { file("/var/log/news/news.err" owner("news")); }; 
114.
destination df_news_dot_crit { file("/var/log/news/news.crit" owner("news")); }; 
115.
 
116.
# some more classical and useful files found in standard syslog configurations 
117.
destination df_debug { file("/var/log/debug"); }; 
118.
destination df_messages { file("/var/log/messages"); }; 
119.
 
120.
# pipes 
121.
# a console to view log messages under X 
122.
destination dp_xconsole { pipe("/dev/xconsole"); }; 
123.
 
124.
# consoles 
125.
# this will send messages to everyone logged in 
126.
destination du_all { usertty("*"); }; 
127.
 
128.
 
129.
###### 
130.
# filters 
131.
 
132.
# all messages from the auth and authpriv facilities 
133.
filter f_auth { facility(auth, authpriv); }; 
134.
 
135.
# all messages except from the auth and authpriv facilities 
136.
filter f_syslog { not facility(auth, authpriv); }; 
137.
 
138.
# respectively: messages from the cron, daemon, kern, lpr, mail, news, user, 
139.
# and uucp facilities 
140.
filter f_cron { facility(cron); }; 
141.
filter f_daemon { facility(daemon); }; 
142.
filter f_kern { facility(kern); }; 
143.
filter f_lpr { facility(lpr); }; 
144.
filter f_mail { facility(mail); }; 
145.
filter f_news { facility(news); }; 
146.
filter f_user { facility(user); }; 
147.
filter f_uucp { facility(uucp); }; 
148.
 
149.
# some filters to select messages of priority greater or equal to info, warn, 
150.
# and err 
151.
# (equivalents of syslogd's *.info, *.warn, and *.err) 
152.
filter f_at_least_info { level(info..emerg); }; 
153.
filter f_at_least_notice { level(notice..emerg); }; 
154.
filter f_at_least_warn { level(warn..emerg); }; 
155.
filter f_at_least_err { level(err..emerg); }; 
156.
filter f_at_least_crit { level(crit..emerg); }; 
157.
 
158.
# all messages of priority debug not coming from the auth, authpriv, news, and 
159.
# mail facilities 
160.
filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; 
161.
 
162.
# all messages of info, notice, or warn priority not coming form the auth, 
163.
# authpriv, cron, daemon, mail, and news facilities 
164.
filter f_messages { 
165.
        level(info,notice,warn) 
166.
            and not facility(auth,authpriv,cron,daemon,mail,news); 
167.
}; 
168.
 
169.
# messages with priority emerg 
170.
filter f_emerg { level(emerg); }; 
171.
 
172.
# complex filter for messages usually sent to the xconsole 
173.
filter f_xconsole { 
174.
    facility(daemon,mail) 
175.
        or level(debug,info,notice,warn) 
176.
        or (facility(news) 
177.
                and level(crit,err,notice)); 
178.
}; 
179.
 
180.
 
181.
###### 
182.
# logs 
183.
# order matters if you use "flags(final);" to mark the end of processing in a 
184.
# "log" statement 
185.
 
186.
# these rules provide the same behavior as the commented original syslogd rules 
187.
 
188.
# auth,authpriv.*                 /var/log/auth.log 
189.
log { 
190.
        source(s_all); 
191.
        filter(f_auth); 
192.
        destination(df_auth); 
193.
}; 
194.
 
195.
# *.*;auth,authpriv.none          -/var/log/syslog 
196.
log { 
197.
        source(s_all); 
198.
        filter(f_syslog); 
199.
        destination(df_syslog); 
200.
}; 
201.
 
202.
# this is commented out in the default syslog.conf 
203.
# cron.*                         /var/log/cron.log 
204.
#log { 
205.
#        source(s_all); 
206.
#        filter(f_cron); 
207.
#        destination(df_cron); 
208.
#}; 
209.
 
210.
# daemon.*                        -/var/log/daemon.log 
211.
log { 
212.
        source(s_all); 
213.
        filter(f_daemon); 
214.
        destination(df_daemon); 
215.
}; 
216.
 
217.
# kern.*                          -/var/log/kern.log 
218.
log { 
219.
        source(s_all); 
220.
        filter(f_kern); 
221.
        destination(df_kern); 
222.
}; 
223.
 
224.
# lpr.*                           -/var/log/lpr.log 
225.
log { 
226.
        source(s_all); 
227.
        filter(f_lpr); 
228.
        destination(df_lpr); 
229.
}; 
230.
 
231.
# mail.*                          -/var/log/mail.log 
232.
log { 
233.
        source(s_all); 
234.
        filter(f_mail); 
235.
        destination(df_mail); 
236.
}; 
237.
 
238.
# user.*                          -/var/log/user.log 
239.
log { 
240.
        source(s_all); 
241.
        filter(f_user); 
242.
        destination(df_user); 
243.
}; 
244.
 
245.
# uucp.*                          /var/log/uucp.log 
246.
log { 
247.
        source(s_all); 
248.
        filter(f_uucp); 
249.
        destination(df_uucp); 
250.
}; 
251.
 
252.
# mail.info                       -/var/log/mail.info 
253.
log { 
254.
        source(s_all); 
255.
        filter(f_mail); 
256.
        filter(f_at_least_info); 
257.
        destination(df_facility_dot_info); 
258.
}; 
259.
 
260.
# mail.warn                       -/var/log/mail.warn 
261.
log { 
262.
        source(s_all); 
263.
        filter(f_mail); 
264.
        filter(f_at_least_warn); 
265.
        destination(df_facility_dot_warn); 
266.
}; 
267.
 
268.
# mail.err                        /var/log/mail.err 
269.
log { 
270.
        source(s_all); 
271.
        filter(f_mail); 
272.
        filter(f_at_least_err); 
273.
        destination(df_facility_dot_err); 
274.
}; 
275.
 
276.
# news.crit                       /var/log/news/news.crit 
277.
log { 
278.
        source(s_all); 
279.
        filter(f_news); 
280.
        filter(f_at_least_crit); 
281.
        destination(df_news_dot_crit); 
282.
}; 
283.
 
284.
# news.err                        /var/log/news/news.err 
285.
log { 
286.
        source(s_all); 
287.
        filter(f_news); 
288.
        filter(f_at_least_err); 
289.
        destination(df_news_dot_err); 
290.
}; 
291.
 
292.
# news.notice                     /var/log/news/news.notice 
293.
log { 
294.
        source(s_all); 
295.
        filter(f_news); 
296.
        filter(f_at_least_notice); 
297.
        destination(df_news_dot_notice); 
298.
}; 
299.
 
300.
 
301.
# *.=debug;\ 
302.
#         auth,authpriv.none;\ 
303.
#         news.none;mail.none     -/var/log/debug 
304.
log { 
305.
        source(s_all); 
306.
        filter(f_debug); 
307.
        destination(df_debug); 
308.
}; 
309.
 
310.
 
311.
# *.=info;*.=notice;*.=warn;\ 
312.
#         auth,authpriv.none;\ 
313.
#         cron,daemon.none;\ 
314.
#         mail,news.none          -/var/log/messages 
315.
log { 
316.
        source(s_all); 
317.
        filter(f_messages); 
318.
        destination(df_messages); 
319.
}; 
320.
 
321.
# *.emerg                         * 
322.
log { 
323.
        source(s_all); 
324.
        filter(f_emerg); 
325.
        destination(du_all); 
326.
}; 
327.
 
328.
 
329.
# daemon.*;mail.*;\ 
330.
#         news.crit;news.err;news.notice;\ 
331.
#         *.=debug;*.=info;\ 
332.
#         *.=notice;*.=warn       |/dev/xconsole 
333.
log { 
334.
        source(s_all); 
335.
        filter(f_xconsole); 
336.
        destination(dp_xconsole); 
337.
};
Mitglied: Evil2000
22.12.2006 um 14:33 Uhr
Zuerst müssen deine switches die möglichkeit haben syslog-nachrichten zu versenden.

Bei source inputs {} kannst du udp(); und tcp(max_connections(100)); angeben, damit lauscht dein Syslog-Server auf der Netzwerkschnittschtelle.
Dem Syslog auf dem Switch musst du natürlich noch beibringen an welche IP er die Syslog Nachrichten senden soll. In der Dokumentation zu deinen Switches sollte das genau beschrieben sein, wie du das dort einstellst. Unter Linux direkt geht das mit der Option destination remote { tcp("<dein_syslog_server>"); }; in der syslog-ng.conf. Damit sendet der Syslogd seine nachrichten an den syslog-server.

Ich hoffe das hilft dir etwas weiter.

Gruß

Evil2000
Bitte warten ..
Ähnliche Inhalte
Router & Routing
gelöst Mehrere Gateways - Syslog nicht an Default Gateway (4)

Frage von sebasscha zum Thema Router & Routing ...

Router & Routing
Syslog von Linksys WRT54G mit TOMATO auf O2 Homebox 6641 USB (1)

Frage von ybBln zum Thema Router & Routing ...

Windows Tools
gelöst ADSIEDIT - Wo Konfiguration? (1)

Frage von emeriks zum Thema Windows Tools ...

DNS
DNS konfiguration Domainname Webseite (11)

Frage von TristanKayser zum Thema DNS ...

Neue Wissensbeiträge
Ubuntu

Ubuntu 17.10 steht zum Download bereit

(3)

Information von Frank zum Thema Ubuntu ...

Datenschutz

Autofahrer-Pranger - Bewertungsportal illegal

(8)

Information von BassFishFox zum Thema Datenschutz ...

Windows 10

Neues Win10 Funktionsupdate verbuggt RemoteApp

(8)

Information von thomasreischer zum Thema Windows 10 ...

Microsoft

Die neuen RSAT-Tools für Win10 1709 sind da

(2)

Information von DerWoWusste zum Thema Microsoft ...

Heiß diskutierte Inhalte
Windows 10
Seekrank bei Windows 10 (18)

Frage von zauberer123 zum Thema Windows 10 ...

Windows 10
Windows 10 Fall Creators Update Fehler (14)

Frage von ZeroCool23 zum Thema Windows 10 ...

Windows Server
Frage zu Server Rack (9)

Frage von rainergugus zum Thema Windows Server ...