syslog远程服务器_如何使用Syslog远程收集服务器事件

syslog远程服务器

Have you ever wished that instead of having to manually login to a server in order to see the system log, the events would simply come to you? How-To Geek goes into how to setup a syslog collector.

您是否曾经希望不必为了查看系统日志而手动登录到服务器，而是将事件简单地带给您？ 入门手册介绍了如何设置系统日志收集器。

总览 (Overview)

Syslog is used on a variety of server/devices to give system information to the system administrator. Out it’s Wiki entry:

Syslog用于各种服务器/设备，以将系统信息提供给系统管理员。 出来是Wiki条目：

Syslog is a standard for computer data logging. It allows separation of the software that generates messages from the system that stores them and the software that reports and analyzes them.

Syslog是计算机数据记录的标准。 它允许将生成消息的软件与存储消息的系统以及报告和分析消息的软件分开。

Syslog can be used for computer system management and security auditing as well as generalized informational, analysis, and debugging messages. It is supported by a wide variety of devices (like printers and routers) and receivers across multiple platforms. Because of this, syslog can be used to integrate log data from many different types of systems into a central repository.

Syslog可用于计算机系统管理和安全审核以及一般性的信息，分析和调试消息。 跨多个平台的各种设备(例如打印机和路由器)和接收器都支持它。 因此，syslog可用于将来自许多不同类型系统的日志数据集成到中央存储库中。

In order to tap that information, one could:

为了利用该信息，可以：

1. Connect to the server/device. Where the how, can change from device to device and if possible at all from where the administrator is in relation to the firewall protecting the asset.
   连接到服务器/设备。 如何更改设备之间的位置，如果可能的话，可以从根本上更改管理员与保护资产的防火墙有关的位置。

2. Find the Syslog file. Which could be in a slightly different location depending on the system/device being accessed. For example, on Debian this is “/var/log/syslog” and on DD-WRT its “/var/log/messages” (almost as if only to spite you…).

   查找系统日志文件。 根据所访问的系统/设备，其位置可能略有不同。 例如，在Debian上，它是“ / var / log / syslog”，在DD-WRT上，它是“ / var / log / messages”(几乎只是为了sp你…… )。

3. Use an  available file viewing utility. Again could be slightly different depending on what is available on the system. For example on Busybox the “less” utility isn’t the full GNU implementation and as such is missing the “Scroll  forward” (+F) function.
   使用可用的文件查看实用程序。 再次取决于系统上的可用内容，可能会略有不同。 例如，在Busybox上，“较少”实用程序不是完整的GNU实现，因此缺少“向前滚动”(+ F)功能。

The alternative would be to setup a Syslog collector and have the Syslog-ing servers/devices send the events to it.

另一种选择是设置Syslog收集器，并让Syslog记录服务器/设备向其发送事件。

先决条件和假设 (Prerequisites & Assumptions)

• A device that supports remote Syslog-ing. In this article we will use DD-WRT as an example.
  支持远程系统日志记录的设备。 在本文中，我们将以DD-WRT为例。
• Syslog uses port 514 UDP, and as such it must be reachable from the device sending the information to the collector.
  Syslog使用端口514 UDP，因此从发送信息到收集器的设备必须可以访问它。
• Some basic networking know how is assumed.
  一些基本的网络知道如何假设。

设置系统日志收集器 (Setup the Syslog collector)

In order to collect the events, one needs to have a Syslog server. While there are a multitude of options like “Kiwi” and “PRTG” to mention a few, we opted to use “Syslog Watcher“.

为了收集事件，需要有一台Syslog服务器。 虽然有很多选项，例如“ Kiwi ”和“ PRTG ”，但我们还是选择使用“ Syslog Watcher ”。

Note: It is recommended that the collecting server will use an IP that won’t change, either by statically assigning it or reserving it in DHCP.

注意：建议通过静态分配或将其保留在DHCP中，收集服务器将使用不会更改的IP。

• Download the latest Syslog Watcher.

  下载最新的Syslog Watcher 。

• Install in the regular “next -> next -> finish” fashion.
  以常规的“下一步->下一个->完成”方式安装。
• Open the program from the “start menu”.
  从“开始菜单”中打开程序。
• When prompted to select the mode of operation, select: “Manage local Syslog server”.
  当提示您选择操作模式时，选择：“管理本地Syslog服务器”。
• If prompted by Windows UAC, approve the administrative rights request.
  如果Windows UAC提示，请批准管理权限请求。
• Start the service by clicking the huge “Play” button on the top left.
  单击左上角的巨大“播放”按钮来启动服务。

While you could further configure the program, for example, as shown in the video tutorials, you don’t have too and it is ready to roll.

尽管可以进一步配置程序，例如，如视频教程所示，但您还不需要这样做，可以开始滚动了。

设置系统日志发送者 (Setup the Syslog sender)

As stated above, we will use DD-WRT for this example. With that said, remote Syslog-ing is a capability supported by most self respecting devices/OSs. Consult the documentation as to how to set it up.

如上所述，在此示例中，我们将使用DD-WRT。 话虽这么说，远程系统日志记录是大多数自尊的设备/ OS支持的功能。 有关如何设置，请查阅文档。

On DD-WRT:

在DD-WRT上：

• Go to the webGUI and select “Services”.
  转到webGUI并选择“服务”。

• Check the Enable checkbox for “Syslogd”.

  选中“ Syslogd”的启用复选框。

  
•  In the Remote Server textbox, put the IP/DNS of the collecting server.
  在“远程服务器”文本框中，放置收集服务器的IP / DNS。
• Save & Apply for the settings to take affect.
  保存并应用以使设置生效。

That is it… your Syslog Watcher should start getting populated by system events.

就是这样……您的Syslog Watcher应该开始被系统事件填充。

How to Remove Advertisements with Pixelserv on DD-WRT” guide, you will be able to see something like the below: 如何在DD-WRT上使用Pixelserv删除广告”指南，那么您将看到类似以下内容：

Enjoy :)

请享用 ：)

---

---

Don’t try to remotely operate any space bridges… :P

不要试图远程操作任何空间桥梁…：P

翻译自: https://www.howtogeek.com/107069/how-to-remotely-collect-server-events-using-syslog/

syslog远程服务器