CentOS-6 Configure Rsyslog

CentOS-6 Configure Rsyslog

 

Server Configuration
Backup and Edit Rsyslog Configuration File
cp /etc/rsyslog.conf /etc/rsyslog.conf.ori

add lines to /etc/rsyslog.conf by running below command


echo "\$template DailyPerHostLogs,\”/var/log/rsyslog/%HOSTNAME%/%HOSTNAME%.%\$YEAR%-%\$MONTH%-%\$DAY%.log\"" >> /etc/rsyslog.conf

echo "\$ModLoad imtcp" >> /etc/rsyslog.conf
echo "$InputTCPServerRun 514" >> /etc/rsyslog.conf
echo "*.* -?DailyPerHostLogs;" >> /etc/rsyslog.conf

echo "$ModLoad imudp.so # provides UDP syslog reception" >> /etc/rsyslog.conf
echo "$UDPServerAddress * # all local interfaces" >> /etc/rsyslog.conf
echo "$UDPServerRun 514 # start UDP server log server receiver" >> /etc/rsyslog.conf


Backup and Edit Rsyslog System Configuration File
cp /etc/sysconfig/rsyslog /etc/sysconfig/rsyslog.ori

edit file /etc/sysconfig/rsyslog as below

SYSLOGD_OPTIONS="-c 3"

Restart Rsyslog Service
service rsyslog restart


Client Configuration

Backup and Edit Rsyslog Configuration File
cp /etc/rsyslog.conf /etc/rsyslog.conf.ori
echo "*.* @@192.168.9.131:514" >> /etc/rsyslog.conf
echo "\$ModLoad imtcp" >> /etc/rsyslog.conf

OR

for Old syslog Server ( Like CentOS -4/5 )

vi /etc/syslog.con

and add below line ( all message will be forwarded to syslog server 192.168.100.10 )


*.* @192.168.100.10 

2) For Windows Servers Install Syslog Agent from Below Location

http://syslogserver.com/syslogagent.html