As it has been mentioned in earlier post, to be able to use the rsyslog as syslog in RHEL5.4/5.5, you need to make changes in /etc/sysconfig/rsyslog and /etc/rsyslog.conf.
Here, more options will be introduced;
- /etc/sysconfig/rsyslog;
SYSLOGD_OPTIONS="-c3"
-c3 : This is a new option to v3, and -c<vers> will turn the backward compatibility mode on. In version3, this will turn the backward compatibility mode, and start the native mode for version3. (RHEL5.5)
- /etc/rsyslog.conf
$ModLoad imudp
$UDPServerRun 514
$ModLoad imuxsock
$ModLoad imklog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$ModLoad imudp – This will enable the udp mode
$UDPServerRun 514 – UDP will use port 514 to accept logging coming from remote hosts
$ModLoad imuxsock – This provides support for local system logging (e.g. via logger command)
$ModLoad imklog – To enable rklogd
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat – old syslog’s compatible timestamp format with lower precision.
Additional Options;
$ModLoad immark - To provide -----MARK-----
$MarkMessageInterval 1800 - 1800== 30 minutes
To enable the remote logging with the same syslog structures with HOSTNAME to be used as differentiators
$template DYNmessages,"/var/log/%HOSTNAME%/messages"
$template DYNsecure,"/var/log/%HOSTNAME%/secure"
$template DYNmaillog,"/var/log/%HOSTNAME%/maillog"
$template DYNcron,"/var/log/%HOSTNAME%/cron"
$template DYNspooler,"/var/log/%HOSTNAME%/spooler"
$template DYNboot,"/var/log/%HOSTNAME%/boot.log"
if \
$source != 'localhost' \
and ( \
($syslogseverity-text == 'info') \
or \
($syslogseverity-text == 'notice') \
) \
and ( \
$syslogfacility-text != 'mail' \
and \
$syslogfacility-text != 'authpriv' \
and \
$syslogfacility-text != 'cron' \
) \
then ?DYNmessages
if \
$source != 'localhost' \
and \
$syslogfacility-text == 'authpriv' \
then ?DYNsecure
if \
$source != 'localhost' \
and \
$syslogfacility-text == 'mail' \
then -?DYNmaillog
if \
$source != 'localhost' \
and \
$syslogfacility-text == 'cron' \
then ?DYNcron
if \
$source != 'localhost' \
and \
(\
$syslogfacility-text == 'uucp' \
or \
$syslogfacility-text == 'news' \
)\
and \
$syslogseverity-text == 'crit' \
then ?DYNspooler
if \
$source != 'localhost' \
and \
$syslogfacility-text == 'local7' \
then ?DYNboot
To enable rsyslog forwarding through TCP port 2010;
*.* @@1.2.3.4:2010
To enable rsyslog forwarding through UDP port 514;
*.* @1.2.3.4:514
To enable rsyslog accepting through TCP port 10514;
(If you are going to use port 10514, don’t forget to add the information to /etc/services)
$modload imtcp
$InputTCPServerRun 10514
For more detailed options, following links would provide right information;
Compatibility Notes for rsyslog v3
rsyslog configuration samples
Sysklogd drop-in with remote logs separated by dynamic directory
Daily Log Rotation
rsyslog very simple config
rsyslog cookbook
Sending Messages to a Remote Syslog Server
Receiving Messages from a Remote System
rsyslog – Documentation
rsyslog sample config
