Top-Themen

AppleEntwicklungHardwareInternetLinuxMicrosoftMultimediaNetzwerkeOff TopicSicherheitSonstige SystemeVirtualisierungWeiterbildungZusammenarbeit

Aktuelle Themen

Administrator.de FeedbackApache ServerAppleAssemblerAudioAusbildungAuslandBackupBasicBatch & ShellBenchmarksBibliotheken & ToolkitsBlogsCloud-DiensteClusterCMSCPU, RAM, MainboardsCSSC und C++DatenbankenDatenschutzDebianDigitiales FernsehenDNSDrucker und ScannerDSL, VDSLE-BooksE-BusinessE-MailEntwicklungErkennung und -AbwehrExchange ServerFestplatten, SSD, RaidFirewallFlatratesGoogle AndroidGrafikGrafikkarten & MonitoreGroupwareHardwareHosting & HousingHTMLHumor (lol)Hyper-VIconsIDE & EditorenInformationsdiensteInstallationInstant MessagingInternetInternet DomäneniOSISDN & AnaloganschlüsseiTunesJavaJavaScriptKiXtartKVMLAN, WAN, WirelessLinuxLinux DesktopLinux NetzwerkLinux ToolsLinux UserverwaltungLizenzierungMac OS XMicrosoftMicrosoft OfficeMikroTik RouterOSMonitoringMultimediaMultimedia & ZubehörNetzwerkeNetzwerkgrundlagenNetzwerkmanagementNetzwerkprotokolleNotebook & ZubehörNovell NetwareOff TopicOpenOffice, LibreOfficeOutlook & MailPapierkorbPascal und DelphiPeripheriegerätePerlPHPPythonRechtliche FragenRedHat, CentOS, FedoraRouter & RoutingSambaSAN, NAS, DASSchriftartenSchulung & TrainingSEOServerServer-HardwareSicherheitSicherheits-ToolsSicherheitsgrundlagenSolarisSonstige SystemeSoziale NetzwerkeSpeicherkartenStudentenjobs & PraktikumSuche ProjektpartnerSuseSwitche und HubsTipps & TricksTK-Netze & GeräteUbuntuUMTS, EDGE & GPRSUtilitiesVB for ApplicationsVerschlüsselung & ZertifikateVideo & StreamingViren und TrojanerVirtualisierungVisual StudioVmwareVoice over IPWebbrowserWebentwicklungWeiterbildungWindows 7Windows 8Windows 10Windows InstallationWindows MobileWindows NetzwerkWindows ServerWindows SystemdateienWindows ToolsWindows UpdateWindows UserverwaltungWindows VistaWindows XPXenserverXMLZusammenarbeit

Syslog-Ng Konfiguration

Frage Linux Linux Netzwerk

Mitglied: tamti

tamti (Level 1) - Jetzt verbinden

06.12.2006, aktualisiert 02.11.2016, 6481 Aufrufe, 1 Kommentar

Hallo zusammen,

also ich bin ein Fachinformatiker Azubi (Fisi erstes Jahr) und habe jetzt eine Aufgabe zum Syslog-Ng bekommen.
Ich soll den so konfigurieren dass er Logdateien von verschiedenen Switches sammelt und jeweils seperat zur jeder Switch speichert.

Leider weiß ich nicht so recht wie ich die "syslog-ng.conf" umschreiben muss damit es glatt funktioniert.

Würde mich freuen wenn mir das jemand kurz erläutern könnte wie man das am besten macht oder den einen oder anderen Nützlichen Link postet welches das schön erklärt.

Bis dann THX

tamti

so sieht die jetzige conf Datei aus.
01.
02.
# Configuration file for syslog-ng under Debian 
03.
04.
# attempts at reproducing default syslog behavior 
05.
 
06.
# the standard syslog levels are (in descending order of priority): 
07.
# emerg alert crit err warning notice info debug 
08.
# the aliases "error", "panic", and "warn" are deprecated 
09.
# the "none" priority found in the original syslogd configuration is 
10.
# only used in internal messages created by syslogd 
11.
 
12.
 
13.
###### 
14.
# options 
15.
 
16.
options { 
17.
        # disable the chained hostname format in logs 
18.
        # (default is enabled) 
19.
        chain_hostnames(0); 
20.
 
21.
        # the time to wait before a died connection is re-established 
22.
        # (default is 60) 
23.
        time_reopen(10); 
24.
 
25.
        # the time to wait before an idle destination file is closed 
26.
        # (default is 60) 
27.
        time_reap(360); 
28.
 
29.
        # the number of lines buffered before written to file 
30.
        # you might want to increase this if your disk isn't catching with 
31.
        # all the log messages you get or if you want less disk activity 
32.
        # (say on a laptop) 
33.
        # (default is 0) 
34.
        #sync(0); 
35.
 
36.
        # the number of lines fitting in the output queue 
37.
        log_fifo_size(2048); 
38.
 
39.
        # enable or disable directory creation for destination files 
40.
        create_dirs(yes); 
41.
 
42.
        # default owner, group, and permissions for log files 
43.
        # (defaults are 0, 0, 0600) 
44.
        #owner(root); 
45.
        group(adm); 
46.
        perm(0640); 
47.
 
48.
        # default owner, group, and permissions for created directories 
49.
        # (defaults are 0, 0, 0700) 
50.
        #dir_owner(root); 
51.
        #dir_group(root); 
52.
        dir_perm(0755); 
53.
 
54.
        # enable or disable DNS usage 
55.
        # syslog-ng blocks on DNS queries, so enabling DNS may lead to 
56.
        # a Denial of Service attack 
57.
        # (default is yes) 
58.
        use_dns(no); 
59.
 
60.
        # maximum length of message in bytes 
61.
        # this is only limited by the program listening on the /dev/log Unix 
62.
        # socket, glibc can handle arbitrary length log messages, but -- for 
63.
        # example -- syslogd accepts only 1024 bytes 
64.
        # (default is 2048) 
65.
        #log_msg_size(2048); 
66.
}; 
67.
 
68.
 
69.
###### 
70.
# sources 
71.
 
72.
# all known message sources 
73.
source s_all { 
74.
        # message generated by Syslog-NG 
75.
        internal(); 
76.
        # standard Linux log source (this is the default place for the syslog() 
77.
        # function to send logs to) 
78.
        unix-stream("/dev/log"); 
79.
        # messages from the kernel 
80.
        file("/proc/kmsg" log_prefix("kernel: ")); 
81.
        # use the above line if you want to receive remote UDP logging messages 
82.
        # (this is equivalent to the "-r" syslogd flag) 
83.
        # udp(); 
84.
}; 
85.
 
86.
 
87.
###### 
88.
# destinations 
89.
 
90.
# some standard log files 
91.
destination df_auth { file("/var/log/auth.log"); }; 
92.
destination df_syslog { file("/var/log/syslog"); }; 
93.
destination df_cron { file("/var/log/cron.log"); }; 
94.
destination df_daemon { file("/var/log/daemon.log"); }; 
95.
destination df_kern { file("/var/log/kern.log"); }; 
96.
destination df_lpr { file("/var/log/lpr.log"); }; 
97.
destination df_mail { file("/var/log/mail.log"); }; 
98.
destination df_user { file("/var/log/user.log"); }; 
99.
destination df_uucp { file("/var/log/uucp.log"); }; 
100.
 
101.
# these files are meant for the mail system log files 
102.
# and provide re-usable destinations for {mail,cron,...}.info, 
103.
# {mail,cron,...}.notice, etc. 
104.
destination df_facility_dot_info { file("/var/log/$FACILITY.info"); }; 
105.
destination df_facility_dot_notice { file("/var/log/$FACILITY.notice"); }; 
106.
destination df_facility_dot_warn { file("/var/log/$FACILITY.warn"); }; 
107.
destination df_facility_dot_err { file("/var/log/$FACILITY.err"); }; 
108.
destination df_facility_dot_crit { file("/var/log/$FACILITY.crit"); }; 
109.
 
110.
# these files are meant for the news system, and are kept separated 
111.
# because they should be owned by "news" instead of "root" 
112.
destination df_news_dot_notice { file("/var/log/news/news.notice" owner("news")); }; 
113.
destination df_news_dot_err { file("/var/log/news/news.err" owner("news")); }; 
114.
destination df_news_dot_crit { file("/var/log/news/news.crit" owner("news")); }; 
115.
 
116.
# some more classical and useful files found in standard syslog configurations 
117.
destination df_debug { file("/var/log/debug"); }; 
118.
destination df_messages { file("/var/log/messages"); }; 
119.
 
120.
# pipes 
121.
# a console to view log messages under X 
122.
destination dp_xconsole { pipe("/dev/xconsole"); }; 
123.
 
124.
# consoles 
125.
# this will send messages to everyone logged in 
126.
destination du_all { usertty("*"); }; 
127.
 
128.
 
129.
###### 
130.
# filters 
131.
 
132.
# all messages from the auth and authpriv facilities 
133.
filter f_auth { facility(auth, authpriv); }; 
134.
 
135.
# all messages except from the auth and authpriv facilities 
136.
filter f_syslog { not facility(auth, authpriv); }; 
137.
 
138.
# respectively: messages from the cron, daemon, kern, lpr, mail, news, user, 
139.
# and uucp facilities 
140.
filter f_cron { facility(cron); }; 
141.
filter f_daemon { facility(daemon); }; 
142.
filter f_kern { facility(kern); }; 
143.
filter f_lpr { facility(lpr); }; 
144.
filter f_mail { facility(mail); }; 
145.
filter f_news { facility(news); }; 
146.
filter f_user { facility(user); }; 
147.
filter f_uucp { facility(uucp); }; 
148.
 
149.
# some filters to select messages of priority greater or equal to info, warn, 
150.
# and err 
151.
# (equivalents of syslogd's *.info, *.warn, and *.err) 
152.
filter f_at_least_info { level(info..emerg); }; 
153.
filter f_at_least_notice { level(notice..emerg); }; 
154.
filter f_at_least_warn { level(warn..emerg); }; 
155.
filter f_at_least_err { level(err..emerg); }; 
156.
filter f_at_least_crit { level(crit..emerg); }; 
157.
 
158.
# all messages of priority debug not coming from the auth, authpriv, news, and 
159.
# mail facilities 
160.
filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; 
161.
 
162.
# all messages of info, notice, or warn priority not coming form the auth, 
163.
# authpriv, cron, daemon, mail, and news facilities 
164.
filter f_messages { 
165.
        level(info,notice,warn) 
166.
            and not facility(auth,authpriv,cron,daemon,mail,news); 
167.
}; 
168.
 
169.
# messages with priority emerg 
170.
filter f_emerg { level(emerg); }; 
171.
 
172.
# complex filter for messages usually sent to the xconsole 
173.
filter f_xconsole { 
174.
    facility(daemon,mail) 
175.
        or level(debug,info,notice,warn) 
176.
        or (facility(news) 
177.
                and level(crit,err,notice)); 
178.
}; 
179.
 
180.
 
181.
###### 
182.
# logs 
183.
# order matters if you use "flags(final);" to mark the end of processing in a 
184.
# "log" statement 
185.
 
186.
# these rules provide the same behavior as the commented original syslogd rules 
187.
 
188.
# auth,authpriv.*                 /var/log/auth.log 
189.
log { 
190.
        source(s_all); 
191.
        filter(f_auth); 
192.
        destination(df_auth); 
193.
}; 
194.
 
195.
# *.*;auth,authpriv.none          -/var/log/syslog 
196.
log { 
197.
        source(s_all); 
198.
        filter(f_syslog); 
199.
        destination(df_syslog); 
200.
}; 
201.
 
202.
# this is commented out in the default syslog.conf 
203.
# cron.*                         /var/log/cron.log 
204.
#log { 
205.
#        source(s_all); 
206.
#        filter(f_cron); 
207.
#        destination(df_cron); 
208.
#}; 
209.
 
210.
# daemon.*                        -/var/log/daemon.log 
211.
log { 
212.
        source(s_all); 
213.
        filter(f_daemon); 
214.
        destination(df_daemon); 
215.
}; 
216.
 
217.
# kern.*                          -/var/log/kern.log 
218.
log { 
219.
        source(s_all); 
220.
        filter(f_kern); 
221.
        destination(df_kern); 
222.
}; 
223.
 
224.
# lpr.*                           -/var/log/lpr.log 
225.
log { 
226.
        source(s_all); 
227.
        filter(f_lpr); 
228.
        destination(df_lpr); 
229.
}; 
230.
 
231.
# mail.*                          -/var/log/mail.log 
232.
log { 
233.
        source(s_all); 
234.
        filter(f_mail); 
235.
        destination(df_mail); 
236.
}; 
237.
 
238.
# user.*                          -/var/log/user.log 
239.
log { 
240.
        source(s_all); 
241.
        filter(f_user); 
242.
        destination(df_user); 
243.
}; 
244.
 
245.
# uucp.*                          /var/log/uucp.log 
246.
log { 
247.
        source(s_all); 
248.
        filter(f_uucp); 
249.
        destination(df_uucp); 
250.
}; 
251.
 
252.
# mail.info                       -/var/log/mail.info 
253.
log { 
254.
        source(s_all); 
255.
        filter(f_mail); 
256.
        filter(f_at_least_info); 
257.
        destination(df_facility_dot_info); 
258.
}; 
259.
 
260.
# mail.warn                       -/var/log/mail.warn 
261.
log { 
262.
        source(s_all); 
263.
        filter(f_mail); 
264.
        filter(f_at_least_warn); 
265.
        destination(df_facility_dot_warn); 
266.
}; 
267.
 
268.
# mail.err                        /var/log/mail.err 
269.
log { 
270.
        source(s_all); 
271.
        filter(f_mail); 
272.
        filter(f_at_least_err); 
273.
        destination(df_facility_dot_err); 
274.
}; 
275.
 
276.
# news.crit                       /var/log/news/news.crit 
277.
log { 
278.
        source(s_all); 
279.
        filter(f_news); 
280.
        filter(f_at_least_crit); 
281.
        destination(df_news_dot_crit); 
282.
}; 
283.
 
284.
# news.err                        /var/log/news/news.err 
285.
log { 
286.
        source(s_all); 
287.
        filter(f_news); 
288.
        filter(f_at_least_err); 
289.
        destination(df_news_dot_err); 
290.
}; 
291.
 
292.
# news.notice                     /var/log/news/news.notice 
293.
log { 
294.
        source(s_all); 
295.
        filter(f_news); 
296.
        filter(f_at_least_notice); 
297.
        destination(df_news_dot_notice); 
298.
}; 
299.
 
300.
 
301.
# *.=debug;\ 
302.
#         auth,authpriv.none;\ 
303.
#         news.none;mail.none     -/var/log/debug 
304.
log { 
305.
        source(s_all); 
306.
        filter(f_debug); 
307.
        destination(df_debug); 
308.
}; 
309.
 
310.
 
311.
# *.=info;*.=notice;*.=warn;\ 
312.
#         auth,authpriv.none;\ 
313.
#         cron,daemon.none;\ 
314.
#         mail,news.none          -/var/log/messages 
315.
log { 
316.
        source(s_all); 
317.
        filter(f_messages); 
318.
        destination(df_messages); 
319.
}; 
320.
 
321.
# *.emerg                         * 
322.
log { 
323.
        source(s_all); 
324.
        filter(f_emerg); 
325.
        destination(du_all); 
326.
}; 
327.
 
328.
 
329.
# daemon.*;mail.*;\ 
330.
#         news.crit;news.err;news.notice;\ 
331.
#         *.=debug;*.=info;\ 
332.
#         *.=notice;*.=warn       |/dev/xconsole 
333.
log { 
334.
        source(s_all); 
335.
        filter(f_xconsole); 
336.
        destination(dp_xconsole); 
337.
};
Mitglied: Evil2000
22.12.2006 um 14:33 Uhr
Zuerst müssen deine switches die möglichkeit haben syslog-nachrichten zu versenden.

Bei source inputs {} kannst du udp(); und tcp(max_connections(100)); angeben, damit lauscht dein Syslog-Server auf der Netzwerkschnittschtelle.
Dem Syslog auf dem Switch musst du natürlich noch beibringen an welche IP er die Syslog Nachrichten senden soll. In der Dokumentation zu deinen Switches sollte das genau beschrieben sein, wie du das dort einstellst. Unter Linux direkt geht das mit der Option destination remote { tcp("<dein_syslog_server>"); }; in der syslog-ng.conf. Damit sendet der Syslogd seine nachrichten an den syslog-server.

Ich hoffe das hilft dir etwas weiter.

Gruß

Evil2000
Bitte warten ..
Neuester Wissensbeitrag
CPU, RAM, Mainboards

Angetestet: PC Engines APU 3a2 im Rack-Gehäuse

Erfahrungsbericht von ashnod zum Thema CPU, RAM, Mainboards ...

Ähnliche Inhalte
SAN, NAS, DAS
Storage RAID LUN Konfiguration - Wie macht ihr es (4)

Frage von Marco-83 zum Thema SAN, NAS, DAS ...

Windows Netzwerk
Konfiguration Linux VM in IIS-Manager (10)

Frage von HansWerner1 zum Thema Windows Netzwerk ...

Windows 7
gelöst Chrome for Work Konfiguration (5)

Frage von xbast1x zum Thema Windows 7 ...

Windows Server
Exchangeserver 2016 - Konfiguration DNS (6)

Frage von Xaero1982 zum Thema Windows Server ...

Heiß diskutierte Inhalte
Windows Server
DHCP Server switchen (25)

Frage von M.Marz zum Thema Windows Server ...

Grafikkarten & Monitore
Win 10 Grafikkarte Crash von Software? (13)

Frage von Marabunta zum Thema Grafikkarten & Monitore ...

Router & Routing
gelöst Empfehlung günstiges ADSL2+ nur Modem (10)

Frage von TimMayer zum Thema Router & Routing ...

Server-Hardware
Lenovo Server System X 3650 M5 Festplatten (9)

Frage von Hendrik2586 zum Thema Server-Hardware ...