centos 8 - rsyslog

#######################

#######  server 2 ########

#######################

 

[root@server2 /]# dnf -y install rsyslog

[root@server2 /]# cp /etc/rsyslog.conf /etc/rsyslog.old

[root@server2 /]# vi /etc/rsyslog.conf

module(load="imudp")             // 주석제거 
input(type="imudp" port="514")  //주석제거

module(load="imtcp")             // 주석제거 
input(type="imtcp" port="514")  //주석제거

 

[root@server2 /]# firewall-cmd --permanent --zone=public --add-port=514/udp
[root@server2 /]# firewall-cmd --permanent --zone=public --add-port=514/tcp
[root@server2 /]# firewall-cmd --reload
[root@server2 /]# firewall-cmd --list-all

[root@server2 /]# systemctl enable rsyslog
[root@server2 /]# systemctl start rsyslog
[root@server2 /]# systemctl status rsyslog

 

[root@server2 /]# netstat -pnltu | grep 514
tcp        0      0 0.0.0.0:514             0.0.0.0:*               LISTEN      40997/rsyslogd
tcp6       0      0 :::514                  :::*                    LISTEN      40997/rsyslogd
udp        0      0 0.0.0.0:514             0.0.0.0:*                           40997/rsyslogd
udp6       0      0 :::514                  :::*                                40997/rsyslogd

 

#######################

#######  server 3 ########

#######################

[root@server3 /]# systemctl status rsyslog   //설치되어 있는지 동작하는지 확인

[root@server3 /]# vi /etc/rsyslog.conf

*.* @192.168.10.210:514 #UDP    //맨 아래쪽 넣기 @하나 넣으면 udp로 통신

 

[root@server3 /]# firewall-cmd --permanent --zone=public --add-port=514/udp
[root@server3 /]# firewall-cmd --reload

[root@server3 /]# systemctl restart rsyslog
[root@server3 /]# systemctl enable rsyslog

 

#######################

#######  server 4 ########

#######################

[root@server4 /]# systemctl status rsyslog   //설치되어 있는지 동작하는지 확인

[root@server4 /]# vi /etc/rsyslog.conf

*.* @@192.168.10.210:514 #TCP   //맨아래쪽에 넣기 @@ 두개 넣으면 tcp로 통신

 

 

[root@server4 /]# firewall-cmd --permanent --zone=public --add-port=514/tdp 
[root@server4 /]# firewall-cmd --reload 

[root@server4 /]# systemctl restart rsyslog 
[root@server4 /]# systemctl enable rsyslog 

 

-------------------------------------------------------------------------------------------

#######################

#######  test ########

#######################

 

server3에서..

[root@server3 /]# logger "hihihiihihiisfsdfsdfdsfsdf server3"
[root@server3 /]# cat /var/log/messages | tail

Jan  7 12:05:03 server3 root[9277]: hihihiihihiisfsdfsdfdsfsdf server3

 

server4에서..

[root@server4 ~]# logger " hihihihihihihihiihihi server4"

[root@server4 ~]# cat /var/log/messages | tail

Jan  7 12:04:32 server4 root[4669]: hihihihihihihihiihihi server4

 

server2에서..

[root@server2 /]# tail -f /var/log/messages

Jan  7 12:04:32 server4 root[4669]: hihihihihihihihiihihi server4
Jan  7 12:05:03 server3 root[9277]: hihihiihihiisfsdfsdfdsfsdf server3