Operation and Maintenance
Linux Operation and Maintenance
How to configure syslog in linux to implement log forwarding
How to configure syslog in linux to implement log forwarding
1. Syslog protocol
Most logs in the Linux system are generated and maintained through a syslog mechanism. Syslog is a protocol that is divided into client and server. The client generates logs and the server receives logs. And save the received log to a file or process it in other ways.
In Linux, the common syslog server-side program is the syslogd daemon. This program receives logs from three places
[1]: unix domain socket /dev/log
[2]: udp port 514
[3]: Special device /dev/klog
Correspondingly, the program that generates log messages needs to write messages through the above three methods. For most programs, log messages are sent to the /dev/log socket.
On Unix operating systems, syslog is widely used for system logs. Syslog log messages can be recorded in local files or sent to the syslog server over the network. The server that receives syslog can uniformly store syslog messages from multiple devices. Or parse the content and process it accordingly. Common application scenarios are network management tools, security management systems, and log management systems. The complete syslog log contains
# [1]: The program module of the log
[2]: Severe
[3]: Time
## [ 4】: Host name or IP 【5】: Process name 【6】: Process ID 【7】: Text In 2001 The BSD syslog protocol is described in RFC3164 defined in 2017: http://www.ietf.org/rfc/rfc3164.txt. However, many contents of this specification are not mandatory, and are often "suggestions" or "conventions". Also because this specification came out relatively late, many devices do not comply or do not fully comply with this specification. Next, we will introduce this specification. It is agreed that the device that sends syslog is Device, the device that forwards syslog is Relay, and the device that receives syslog is Collector. Relay itself can also send its own syslog to the Collector, at which time it appears as a Device. Relay can also forward only part of the received syslog messages. At this time, it behaves as both Relay and Collector. Syslog messages are sent to the UDP 514 port of the Collector without requiring a response from the receiver. RFC3164 recommends that Device also use 514 as the source port. It is specified that the UDP packet of the syslog message cannot exceed 1024 bytes and must be composed entirely of printable characters. The complete syslog message consists of 3 parts, namely PRI, HEADER and MSG. Most syslogs contain PRI and MSG sections, while HEADER may not. 2. Configure syslog server and client to implement log forwardingEnvironment: ubantu16.04
1. Server
<1> Modify /etc/default/rsyslog
## <1> SYSLOGD_OPTIONS is "-r -x -m 0"-r means to allow receiving external messages -x means not to parse DNS,
-m 0 Indicates the timestamp mark interval,
If you specify to only accept logs from one or more ips, for example "-s 168.1.1.1:168.1.1.2"
& gt; Modify /etc/rsyslog.conf
# completely Nance:$ModLoad imudp.so $UDPServerRun 514
add these two sentences at the end of the file
syslog.info;syslog.!err;syslog.!crit;syslog.!alert /var/log/mylog #info信息记录到日志服务器的/var/log/mylog中 syslog.err /var/log/testerror #error信息记录到日志服务器的/var/log/testerror中 2 、客户端
Modify /etc/syslog.conf Add
Cancellation Note:
$ModLoad imudp.so $UDPServerRun 514r r r r r r r
# syslog.info @IP (IP is the server IP address)
3. Service restart
4. Test
##### #### Run the following code on the client, and you can see in the server/var/log/mylog that the log has been saved to the server#######include <stdio.h>
#include <syslog.h>
int main(int argc, char* argv[])
{
//openlog(argv[0], LOG_CONS | LOG_PID, LOG_USER);
int count = 0;
while(count<5){
syslog(LOG_SYSLOG|LOG_INFO, "%d:, syslog user test", count);
count++;
}
//closelog();
return 0;
}The above is the detailed content of How to configure syslog in linux to implement log forwarding. For more information, please follow other related articles on the PHP Chinese website!
Hot AI Tools
Undress AI Tool
Undress images for free
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
How does resource usage (CPU, memory) differ between Linux and Windows?
Jun 05, 2025 am 12:13 AM
Linux and Windows have their own advantages and disadvantages in CPU and memory usage: 1) Linux uses time slice-based scheduling algorithms to ensure fairness and efficiency; Windows uses priority scheduling, which may cause low-priority processes to wait. 2) Linux manages memory through paging and switching mechanisms to reduce fragmentation; Windows tends to pre-allocate and dynamic adjustment, and efficiency may fluctuate.
How does the cost of ownership differ between Linux and Windows?
Jun 09, 2025 am 12:17 AM
Linux's cost of ownership is usually lower than Windows. 1) Linux does not require license fees, saving a lot of costs, while Windows requires purchasing a license. 2) Linux has low hardware requirements and can extend the service life of the device. 3) The Linux community provides free support to reduce maintenance costs. 4) Linux is highly secure and reduces productivity losses. 5) The Linux learning curve is steep, but Windows is easier to use. The choice should be based on specific needs and budget.
How does the performance of I/O operations differ between Linux and Windows?
Jun 07, 2025 am 12:06 AM
LinuxoftenoutperformsWindowsinI/Operformanceduetoitscustomizablekernelandfilesystems,whileWindowsoffersmoreuniformperformanceacrosshardware.1)LinuxexcelswithcustomizableI/OschedulerslikeCFQandDeadline,enhancingperformanceinhigh-throughputapplications
How to install Linux alongside Windows (dual boot)?
Jun 18, 2025 am 12:19 AM
The key to installing dual systems in Linux and Windows is partitioning and boot settings. 1. Preparation includes backing up data and compressing existing partitions to make space; 2. Use Ventoy or Rufus to make Linux boot USB disk, recommend Ubuntu; 3. Select "Coexist with other systems" or manually partition during installation (/at least 20GB, /home remaining space, swap optional); 4. Check the installation of third-party drivers to avoid hardware problems; 5. If you do not enter the Grub boot menu after installation, you can use boot-repair to repair the boot or adjust the BIOS startup sequence. As long as the steps are clear and the operation is done properly, the whole process is not complicated.
How to enable the EPEL (Extra Packages for Enterprise Linux) repository?
Jun 17, 2025 am 09:15 AM
The key to enabling EPEL repository is to select the correct installation method according to the system version. First, confirm the system type and version, and use the command cat/etc/os-release to obtain information; second, enable EPEL through dnfinstallepel-release on CentOS/RockyLinux, and the 8 and 9 version commands are the same; third, you need to manually download the corresponding version of the .repo file and install it on RHEL; fourth, you can re-import the GPG key when encountering problems. Note that the old version may not be supported, and you can also consider enabling epel-next to obtain the test package. After completing the above steps, use dnfrepolist to verify that the EPEL repository is successfully added.
How does Linux perform compared to Windows for web server workloads?
Jun 08, 2025 am 12:18 AM
Linux usually performs better in web server performance, mainly due to its advantages in kernel optimization, resource management and open source ecosystem. 1) After years of optimization of the Linux kernel, mechanisms such as epoll and kqueue make it more efficient in handling high concurrent requests. 2) Linux provides fine-grained resource management tools such as cgroups. 3) The open source community continuously optimizes Linux performance, and many high-performance web servers such as Nginx are developed on Linux. By contrast, Windows performs well when handling ASP.NET applications and provides better development tools and commercial support.
How to choose a Linux distro for a beginner?
Jun 19, 2025 am 12:09 AM
Newbie users should first clarify their usage requirements when choosing a Linux distribution. 1. Choose Ubuntu or LinuxMint for daily use; programming and development are suitable for Manjaro or Fedora; use Lubuntu and other lightweight systems for old devices; recommend CentOSStream or Debian to learn the underlying principles. 2. Stability is preferred for UbuntuLTS or Debian; you can choose Arch or Manjaro to pursue new features. 3. In terms of community support, Ubuntu and LinuxMint are rich in resources, and Arch documents are technically oriented. 4. In terms of installation difficulty, Ubuntu and LinuxMint are relatively simple, and Arch is suitable for those with basic needs. It is recommended to try it first and then decide.
How to add a new disk to Linux
Jun 27, 2025 am 12:15 AM
The steps to add a new hard disk to the Linux system are as follows: 1. Confirm that the hard disk is recognized and use lsblk or fdisk-l to check; 2. Use fdisk or parted partitions, such as fdisk/dev/sdb and create and save; 3. Format the partition to a file system, such as mkfs.ext4/dev/sdb1; 4. Use the mount command for temporary mounts, such as mount/dev/sdb1/mnt/data; 5. Modify /etc/fstab to achieve automatic mount on the computer, and test the mount first to ensure correctness. Be sure to confirm data security before operation to avoid hardware connection problems.
