Debian 11 Bullseye
Sponsored Link

Rsyslog : Basic Usage
2021/09/23
 
This is Basic Usage of Rsyslog that is the Log Management Service Daemon.
[1] Stored rules of logging data are configured in [/etc/rsyslog.conf].
root@dlp:~#
grep -v -E "^#|^$" /etc/rsyslog.conf

module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err
*.=debug;\
        auth,authpriv.none;\
        mail.none               -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail.none               -/var/log/messages
*.emerg                         :omusrmsg:*



# * how to write rules : (Facility).(Priority)  (Action)
#
# ex : *.info;mail.none;authpriv.none;cron.none /var/log/messages
# ⇒ [syslog] messages of [info] Priority of all Facilities are stored in [/var/log/messages]
# ⇒ but messages of [mail], [authpriv], [cron] Facilities are not stored in [/var/log/messages]
#
# * the [-] that is added at the head of a filename means asynchronous output
#   if [-] is not added, logging data are written with synchronous output

# * Facilities
# kern             :  kernel messages
# auth             :  authentication related messages
# authpriv         :  authentication related messages (private)
# cron             :  cron or at related messages
# mail             :  mail services related messages
# news             :  news related messages
# uucp             :  uucp related messages
# daemon           :  daemon services related messages
# user             :  user level processes related messages
# lpr              :  printer related messages
# syslog           :  internal syslog related messages
# local0 - local7  :  possible to use for custom settings

# * Priorities
# emerg            :  maybe panic level troubles
# alert            :  need to correct immediately more than critical
# crit             :  need to correct immediately
# err              :  common errors, non urgent failures
# warning          :  warning messages
# notice           :  not errors but some unusual events detected
# info             :  normal operational messages
# debug            :  debug information
# none             :  none (not output)

# * if you'd like to store only specified priority messages
# add [=] like follows
# ex : kern.=crit     /dev/console
[2] To transfer logging data to remote Hosts, Configure like follows.
###### on Syslog Server Host (receives logging data from other Hosts) ######

root@dlp:~#
vi /etc/rsyslog.conf
# line 20-21 : uncomment
line 22 : set allowed hosts to connect
module(load="imtcp")
input(type="imtcp" port="514")
$AllowedSender TCP, 127.0.0.1, 10.0.0.0/24, *.srv.world

root@dlp:~#
systemctl restart rsyslog

###### on Sender Host (sends logging data to Syslog Server Host) ######

root@node01:~#
vi /etc/rsyslog.conf
# add to the end

action(type="omfwd"
       queue.filename="fwdRule_dlp.srv.world"
       queue.maxdiskspace="1g"
       queue.saveonshutdown="on"
       queue.type="LinkedList"
       action.resumeRetryCount="-1"
       Target="dlp.srv.world" Port="514" Protocol="tcp")

# queue.filename               :   queue filename
# queue.maxdiskspace           :   maxdiskspace for queue
# queue.saveonshutdown=on      :   save queue data on disk when system shutdown
# queue.type=LinkedList        :   asynchronous queue which can store 10,000 messages
# action.resumeRetryCount=-1   :   continue to retry sending when syslog server does not respond
# Target=***                   :   specify syslog server Host

root@node01:~#
systemctl restart rsyslog

###### that's OK, verify settings to see logs on syslog server Host ######

root@dlp:~#
tail /var/log/auth.log

Sep 22 23:24:34 dlp login[437]: pam_unix(login:session): session opened for user root(uid=0) by LOGIN(uid=0)
Sep 22 23:24:34 dlp systemd-logind[430]: New session 1 of user root.
Sep 22 23:24:34 dlp systemd: pam_unix(systemd-user:session): session opened for user root(uid=0) by (uid=0)
Sep 22 23:24:34 dlp login[496]: ROOT LOGIN  on '/dev/ttyS0'
Sep 23 23:49:15 node01 sshd[1327]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1  user=debian
Sep 23 23:49:17 node01 sshd[1327]: Failed password for debian from ::1 port 45454 ssh2
Sep 23 23:49:20 node01 sshd[1327]: Failed password for debian from ::1 port 45454 ssh2
Sep 23 23:49:23 node01 sshd[1327]: Failed password for debian from ::1 port 45454 ssh2
Sep 23 23:49:23 node01 sshd[1327]: Connection closed by authenticating user debian ::1 port 45454 [preauth]
Sep 23 23:49:23 node01 sshd[1327]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1  user=debian
Matched Content