linux for cisco 日志服务器搭建

目的:
搭建记录CISCO 日志事件的LINUX服务器.
2.cisco交换机地址:192.168.0.1
 Linux地址:192.168.0.252
3.试验步骤主要分两大块
 1)交换机
首先设置交换机能够发出日志
开启:
(config)#logging on   (开启日志)
(config)# logging facility local5 (local5设备号,这要和LINUX那对应)
(config)#logging host 192.168.0.252
(config)#logging trap 6
注意:logging trap level 指定日志消息的级别 
logging facility命令更改设备号,并Show logging
 2)LINUX
2.1 设置/etc/syslog.conf 配置文件文件(此文件是设置cisco发过来的文件到那个文件)
[root@localhost log]# vi /etc/syslog.conf
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;news.none;authpriv.none;cron.none              /var/log/messages
# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure
# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog

# Log cron stuff
cron.*                                                  /var/log/cron
# Everybody gets emergency messages
*.emerg                                                 *
# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler
# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log
#Save router message also to router.log
local4.*                                                /var/log/router.log
#Save switch message also to switch.log
local5.*                                                /var/log/switch.log
#
# INN
#
news.=crit                                        /var/log/news/news.crit
news.=err                                         /var/log/news/news.err
news.notice                                       /var/log/news/news.notice
(*表示所有消息)   (这里local5就是和cisco设置的local5对应,并且它把cisco发过来的日志放到var/log/switch.log)
可以用man syslog 共有8种消息等级.
#define KERN_EMERG    "<0>" /* system is unusable               */
       #define KERN_ALERT    "<1>" /* action must be taken immediately */
       #define KERN_CRIT     "<2>" /* critical conditions              */
       #define KERN_ERR      "<3>" /* error conditions                 */
       #define KERN_WARNING "<4>" /* warning conditions               */
       #define KERN_NOTICE   "<5>" /* normal but significant condition */
       #define KERN_INFO     "<6>" /* informational                    */
       #define KERN_DEBUG    "<7>" /* debug-level messages             */
alert －需要立即采取的动作
   crit －临界状态
   err －错误状态。等同 error
   warning －预警信息，等同 warn
   notice －正常但是要注意
   info －正常消息
   debug －调试
   none －一般的信息
 
 
2.2修改配置文件/etc/sysconfig/syslog
改这里是因为需要linux去读取来的消息
 
# Options to syslogd
# -m 0 disables 'MARK' messages.
# -r enables logging from remote machines
# -x disables DNS lookups on messages recieved with –r (不用DNS解析)
# See syslogd(8) for more details
SYSLOGD_OPTIONS=" -m 0"      修改为 SYSLOGD_OPTIONS="-r -x -m 0"
# Options to klogd
# -2 prints all kernel oops messages twice; once for klogd to decode, and
#    once for processing with 'ksymoops'
# -x disables all klogd processing of oops messages entirely
# See klogd(8) for more details
KLOGD_OPTIONS="-x"
#
SYSLOG_UMASK=077
# set this to a umask value to use for all log files as in umask(1).
# By default, all permissions are removed for "group" and "other".
2.3修改文件syslog 之后
   重启syslog服务
     Service syslog restart
2.4 查看syslogd进程
ps –ef |grep syslogd |grep –v “grep syslogd”
root     30307     1 0 13:59 ?       00:00:00 syslogd -r -x -m     ###有-r 就表示成功
2.5 设置 LINUX 允许 cisco 数据包进来 .
[root@localhost log]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
ACCEPT     udp -- anywhere             192.168.80.63       udp dpt:syslog
 
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
 
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination       
 
命令是: iptables –A INPUT –p udp –d 192.168.80.63 –dport 514 –j ACCEPT
2.6  查看日志服务器监听的 udp 端口： 514
     netstat -untl |grep 514
udp        0      0 0.0.0.0:514              0.0.0.0:*        ###514 已经起来
 
这样,查看80.log是否有记录
[root@localhost log]# cat /var/log/switch.log

       Sep 21 10:09:44 192.168.0.1 84: 3d10h: %SYS-5-CONFIG_I: Configured from console
by root on vty0 (192.168.0.252)