1、在服务器上修改配置文件

[root@ServerB var]# vim/etc/sysconfig/syslog

# Options to syslogd

# -m 0 disables 'MARK' messages. 禁用“标记”的消息

# -r enables logging from remote machines 接收远程主机消息

# -x disables DNS lookups on messagesrecieved with –r 禁用DNS查找信息接收与

# See syslogd(8) for more details

SYSLOGD_OPTIONS="-m 0 -r"

# Options to klogd

# -2 prints all kernel oops messages twice;once for klogd to decode, and

# once for processing with 'ksymoops'

# -x disables all klogd processing of oopsmessages entirely

# See klogd(8) for more details

KLOGD_OPTIONS="-x"

#

SYSLOG_UMASK=077

# set this to a umask value to use for alllog files as in umask(1).

# By default, all permissions are removedfor "group" and "other".

[root@ServerB var]# service syslog start 重新启动服务

启动系统日志记录器：

启动内核日志记录器：

[root@ServerB var]#


2、编辑客户机的配置文件

[root@ServerA ~]# vim /etc/syslog.conf

# Log all kernel messages to the console.

# Logging much else clutters up the screen.

#kern.* /dev/console


# Log anything (except mail) of level infoor higher.

# Don't log private authenticationmessages!

*.info;mail.none;authpriv.none;cron.none /var/log/messages

/其中*是通配符，代表任何设备；none表示不对任何级别的信息进行记录。

# The authpriv file has restricted access.

authpriv.* /var/log/secure

//将authpirv设备的任何级别的信息记录到/var/log/secure文件中，这主要是一些和认、权限使用相关的信息。

# Log all the mail messages in one place.

mail.* -/var/log/maillog

//将mail设备中的任何级别的信息记录到/var/log/maillog文件中，这主要是和电子邮件相关的信息


# Log cron stuff

cron.* /var/log/cron

cron.* @192.168.1.2指定存放日志的位置

//将cron设备中的任何级别的信息记录到/var/log/cron文件中，这主要是和系统中定期执行的任务相关的信息。

# Everybody gets emergency messages

*.emerg *

//将任何设备的emerg级别的信息发送给所有正在系统上的用户。

# Save news errors of level crit and higherin a special file.

uucp,news.crit /var/log/spooler

//将uucp和news设备的crit级别的信息记录到/var/log/spooler文件中。

# Save boot messages also to boot.log

local7.* /var/log/boot.log

//将和系统启动相关的信息记录到/var/log/boot.log文件中。

3、在服务器上时间查看计划任务日志

[root@ServerB var]# tail -f /var/log/cron

4、重启客户端日志服务器

[root@ServerA~]# /etc/init.d/syslog restart

关闭内核日志记录器： [确定]

关闭系统日志记录器： [确定]

启动系统日志记录器： [确定]

启动内核日志记录器： [确定]

[root@ServerA ~]#

5、日志服务器日志产生

[root@ServerB var]# tail -f /var/log/cron

Nov 2 12:01:02 ServerB crond[3696]: (root) CMD (run-parts /etc/cron.hourly)

Nov 2 12:34:15 ServerB anacron[3436]: Job `cron.daily' started

Nov 2 12:34:33 ServerB anacron[3436]: Job `cron.daily' terminated

Nov 2 12:34:33 ServerB anacron[3436]: Normal exit (1 jobs run)

Nov 2 13:01:01 ServerB crond[4023]: (root) CMD (run-parts /etc/cron.hourly)

Nov 2 14:01:01 ServerB crond[4156]: (root) CMD (run-parts /etc/cron.hourly)

Nov 2 15:01:01 ServerB crond[4442]: (root) CMD (run-parts /etc/cron.hourly)

Nov 2 16:01:01 ServerB crond[4625]: (root) CMD (run-parts /etc/cron.hourly)

Nov 2 17:01:01 ServerB crond[4787]: (root) CMD (run-parts /etc/cron.hourly)

Nov 2 18:01:01 ServerB crond[4926]: (root) CMD (run-parts /etc/cron.hourly)