双机系统:linux/redhat6.8
syslog-ng版本:3.5.4.1
1、具体安装syslog-ng此处不给出。
2、syslog-ng server配置:
@version: 3.5
@include "scl.conf"
options {
time-reap(30);
mark-freq(10);
keep-hostname(yes);
};
source s_local { system(); internal(); };
source s_network {
syslog(transport("tcp") port("514"));
};
destination d_local {
file("/var/log/syslog-ng/message"); };
destination d_logs {
file(
"/var/log/syslog-ng/logs.txt"
); };
log { source(s_network); destination(d_logs); };
log { source(s_local); destination(d_local); };
3、syslog-ng client配置:
@version: 3.5
@include "scl.conf"
destination d_local {
file("/var/log/syslog-ng/message");
};
destination d_syslog_tcp {
syslog("192.168.241.148" transport("tcp") port(514));};
log { source(s_local); destination(d_syslog_tcp); destination(d_local); };
进过实测 server端可以实时收集client端的linux日志以及syslog内部日志。
最后提个问题:在测试时,server端虽然可以收集client端日志。但是cisco-ISE发送的UDP日志却无法收集。不知道有没有高手清楚为什么!欢迎回复,谢谢!
******自己补充下,配置完全没有问题,之所以收不到ISE日志,最后发现是看错文件目录了******