Configure logging server

Configure logging server:

This is one of the RHCE exam objective under system administration. Logging server generally accepts different logs from clients. It's most useful if some can't login to remote system and check the logs also provides easy log management.
Edit the following directives to accept log files in /etc/rsyslog.conf

To accept UDP log files

#$ModLoad imudp

#$UDPServerRun 514 

To accept TCP logs

$ModLoad imtcp

$InputTCPServerRun 514

And restart the service

#/etc/init.d/rsyslogd restart

Configure logging clients

Logging clients are the one send log details to central log server.
To configure local system to send  all logging messages, over TCP port 514 to a remote host on IP address 192.168.122.1, you’d add the following command:

                *.* @@192.168.122.1:214

Alternatively, to configure just mail messages to be sent over UDP port 514 to a remote host  on IP address 192.168.100.1, you’d add the following command:

                mail.* @192.168.100.1:514

*.* send all logging messages. A single @ represents UDP communication and a double @@ represents TCP communication.

Download As PDF