linux指定syslog端口号,linux – syslog ip使用`rsyslog`到特定文件

rsyslogd配置

在/etc/rsyslogd.conf中

# provides remote UDP syslog reception

$ModLoad imudp

$UDPServerRun 514

# If logging to an NFS mount, use these settings...

# "OMFileFlushOnTXEnd off" avoids fsync on every write...

# mount -o hard,rsize=32768,wsize=32768,noacl,noatime,nodiratime -t nfs

$OMFileIOBufferSize 768k

$OMFileAsyncWriting on

$OMFileFlushOnTXEnd off

$OMFileFlushInterval 10

$MainMsgQueueSize 100000

# kill all INTF-FLAP messages...

if $msg contains 'INTF-FLAP' then /dev/null

&~

## Cisco ACS Accounting...

if ($fromhost-ip=='172.17.16.20') and ($programname == 'CSCOacs_TACACS_Accounting') then /var/log/tacacs_acct.log

&~

## CiscoACS 5.4 TACACS Authentication

if ($fromhost-ip=='172.17.16.20') and ($programname == 'CSCOacs_Passed_Authentications') then /var/log/tacacs_auth.log

&~

# Logging for Chicago issues...

if $fromhost-ip startswith '172.17.25' then /var/log/net/chicago.log

& ~

# Logging for Dallas issues...

if $fromhost-ip startswith '172.17.27' then /var/log/net/dallas.log

& ~

# Logging for firewall...

if $fromhost-ip=='172.17.4.4' then @10.14.12.12

if $fromhost-ip=='172.17.4.4' then /var/log/net/firewall.log

& ~

每个&〜条目都可以防止落入rsyslog.conf配置的其余部分;因此我不会在/ var / log / messages中看到路由器syslog条目.

触摸所有syslog文件：

>触摸/var/log/net/chicago.log

>触摸/var/log/net/dallas.log

>触摸/var/log/net/firewall.log

使用/etc/init.d/rsyslogd restart重新启动rsyslogd

记录旋转

在/etc/logrotate.d/rsyslog中

/var/log/net/*.log

{

copytruncate

rotate 30

daily

missingok

dateext

notifempty

delaycompress

create root 664 root root

compress

maxage 31

sharedscripts

lastaction

# RHEL: Use "/sbin/service rsyslog restart"

# Debian / Ubuntu: Use "invoke-rc.d rsyslog reload > /dev/null"

invoke-rc.d rsyslog reload > /dev/null

endscript

}