Log centralizzato e fault tolerant con rsyslog - Revision history

Gabriele.vivinetto at 14:49, 3 July 2014

2014-07-03T14:49:00Z

← Older revision		Revision as of 14:49, 3 July 2014
Line 52:		Line 52:

	* '''ATTENZIONE: è possibile che la directory remotes-hosts ed i file di log remoti vengano creati con un certo ritardo'''		* '''ATTENZIONE: è possibile che la directory remotes-hosts ed i file di log remoti vengano creati con un certo ritardo'''
			==Riferimenti==
			*[http://serverfault.com/questions/383530/rsyslog-how-do-i-direct-messages-from-all-remote-machines-to-one-file linux - rsyslog: How do I direct messages from all remote machines to one file? - Server Fault]
			*[http://www.thegeekstuff.com/2012/01/rsyslog-remote-logging/ How to Setup Rsyslog Remote Logging on Linux (Central Log Server)]
			*[http://www.rsyslog.com/article60/ How to separate log files by host name of sending device?]
			*[http://www.linux.com/community/forums/productivity/prevent-rsyslog-from-writing-messages-from-remote-hosts-to-var-log-messages Prevent rsyslog from writing messages from remote hosts to /var/log/messages \| Linux.com]
			*[http://www.rsyslog.com/storing-messages-from-a-remote-system-into-a-specific-file/ Storing Messages from a Remote System into a specific File]

	=Client=		=Client=

Gabriele.vivinetto at 14:46, 3 July 2014

2014-07-03T14:46:52Z

← Older revision		Revision as of 14:46, 3 July 2014
Line 3:		Line 3:

	=Server=		=Server=
	~~server~~		* Installare rsyslog ed il pacchetto relp
	sudo apt-get install rsyslog-relp		sudo apt-get install rsyslog rsyslog-relp

			* Impostare relp sulla porta 20154

			<pre>
	cat \| sudo tee /etc/rsyslog.d/relpserver.conf <<'EOFile'		cat \| sudo tee /etc/rsyslog.d/relpserver.conf <<'EOFile'
	$ModLoad imrelp # Load the input module ('im') 'relp'		$ModLoad imrelp # Load the input module ('im') 'relp'
	$InputRELPServerRun 20514 # Set the port to 20514		$InputRELPServerRun 20514 # Set the port to 20514
	EOFile		EOFile
			</pre>

			* Riavviare rsyslog
	sudo invoke-rc.d rsyslog restart		sudo invoke-rc.d rsyslog restart

	sudo netstat -anp \| grep 20514		* Controlalre che il modulo sia in ascolto
			sudo netstat -anp \| grep 20514

	tcp 0 0 0.0.0.0:20514 0.0.0.0:* LISTEN 15701/rsyslogd		tcp 0 0 0.0.0.0:20514 0.0.0.0:* LISTEN 15701/rsyslogd
	tcp6 0 0 :::20514 :::* LISTEN 15701/rsyslogd		tcp6 0 0 :::20514 :::* LISTEN 15701/rsyslogd

	telnet ~~localhost~~ 20514		* Verificare di poter accedere anche da remoto
			telnet server.example.com 20514

			<pre>
	Trying ::1...		Trying ::1...
	Connected to localhost.		Connected to localhost.
Line 26:		Line 34:
	0 serverclose 0		0 serverclose 0
	Connection closed by foreign host.		Connection closed by foreign host.
			</pre>

			* Se si vuole che gli host remoti vengano loggati separatamente dal log di sistema, inserire questa regole, che deve essere la '''PRIMA''' caricata (ordine alfabetico in /etc/rsyslog.d):

			<pre>
			cat \| sudo tee /etc/rsyslog.d/00remotes.conf <<'EOFile
			$template RemoteHost,"/var/log/remote-hosts/%HOSTNAME%/syslog"

			#if rule to call RemoteHost template
			if ($hostname != 'galstorage01') then ?RemoteHost
			& ~
			EOFile
			</pre>

			* Riavviare rsyslog
			sudo invoke-rc.d rsyslog restart

			* '''ATTENZIONE: è possibile che la directory remotes-hosts ed i file di log remoti vengano creati con un certo ritardo'''

	=Client=		=Client=
	sudo apt-get install rsyslog-relp		* Installare i pacchetti
			sudo apt-get install rsyslog rsyslog-relp

			* Configurare il modulo, ''IMPOSTANDO IL NOME DEL SERVER RSYSLOG''':

			<pre>
	cat \| sudo tee /etc/rsyslog.d/relpclient.conf <<'EOFile'		cat \| sudo tee /etc/rsyslog.d/relpclient.conf <<'EOFile'
	$ModLoad omrelp		$ModLoad omrelp
Line 36:		Line 66:
	$ActionResumeRetryCount -1 # infinite retries on insert failure		$ActionResumeRetryCount -1 # infinite retries on insert failure
	$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down		$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
	. :omrelp:~~fire~~.~~rvmgroup~~.it:20514;RSYSLOG_ForwardFormat		. :omrelp:server.example.com:20514;RSYSLOG_ForwardFormat
	EOFile		EOFile
			</pre>

			*Riavviare rsyslog:
	sudo invoke-rc.d rsyslog restart		sudo invoke-rc.d rsyslog restart

	~~Test~~		* Testare:

	logger This is a Catalog test		logger This is a Catalog test

Gabriele.vivinetto: Created page with "* Con rsyslog, è possibile far loggare un client verso un server centrale. In caso di indisponibilità del server centrale, tramite il modulo relp, il logging verrà conserva..."

2014-07-03T13:50:46Z

Created page with "* Con rsyslog, è possibile far loggare un client verso un server centrale. In caso di indisponibilità del server centrale, tramite il modulo relp, il logging verrà conserva..."

New page

* Con rsyslog, è possibile far loggare un client verso un server centrale. In caso di indisponibilità del server centrale, tramite il modulo relp, il logging verrà conservato in locale, ed alla riconnessione, verrà scritto.

=Server=
server
sudo apt-get install rsyslog-relp

cat | sudo tee /etc/rsyslog.d/relpserver.conf <<'EOFile'
$ModLoad imrelp # Load the input module ('im') 'relp'
$InputRELPServerRun 20514 # Set the port to 20514
EOFile

sudo invoke-rc.d rsyslog restart

sudo netstat -anp | grep 20514

tcp 0 0 0.0.0.0:20514 0.0.0.0:* LISTEN 15701/rsyslogd
tcp6 0 0 :::20514 :::* LISTEN 15701/rsyslogd

telnet localhost 20514

Trying ::1...
Connected to localhost.
Escape character is '^]'.

0 serverclose 0
Connection closed by foreign host.

=Client=
sudo apt-get install rsyslog-relp

cat | sudo tee /etc/rsyslog.d/relpclient.conf <<'EOFile'
$ModLoad omrelp
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName srvrfwd # set file name, also enables disk mode
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
*.* :omrelp:fire.rvmgroup.it:20514;RSYSLOG_ForwardFormat
EOFile

sudo invoke-rc.d rsyslog restart

Test

logger This is a Catalog test

=Riferimenti=
*[http://gertverdemme.nl/sysadm/security/rsyslog_relp_remote_logging Rsyslog remote logging using RELP [Gertverdemme.nl]]
*[http://catalog.readthedocs.org/en/latest/userguide/beginner-guide.html Beginner’s Guide — Catalog 0 documentation]
*[http://www.rsyslog.com/doc/rsyslog_reliable_forwarding.html Reliable Forwarding of syslog Messages (via plain TCP syslog)]