syslog (syslog.conf)

syslog

Categoria: Segurança

Software: syslog

[ Hits: 12.802 ]

Por: Vinícius de Paula figueiredo


Este conf foi escrito para que o administrador possa acompanhar melhor e detalhadamente todos os eventos que ocorrem no sistema.
Esta totalmente comentado, é bê-á-bá.


## Configuracao do SYSLOG ##

## Logar todos os acessos e mensagens geradas por usuarios
auth.*;authpriv.*;user.*;syslog.*   /var/log/users

## Mensagens de ocorrencias geradas por agendadores "CRON" e "AT"
cron.*   /var/log/agendadores

## Mensagens geradas pelos daemons de rede
daemon.*;ftp.*;mail.*   /var/log/daemons

## Registrar mensagens a nivel de debug
*.=debug   /var/log/debug

## Registrar mensagens geradas pelo KERNEL
kern.*   /var/log/kernel

## Enviar mensagens de emergencia para todos os usuarios
*.emerg   *

## Mensagens criticas!!!
*.=crit   /var/log/critico

## Monitorar todos os eventos atraves do tty10
*.*   |/dev/tty10
  


Comentários
[1] Comentário enviado por rafaelpunky em 22/06/2011 - 15:39h

Boa tarde,
Até aqui eu entendi, OK.
Agora como eu faço para ele fazer isso diariamente, com data(DD/MM/AAAA)-hora(HH:MM).log
Eu consigo ver pelo Centreon, mas não sei se é o arquivo /var/log/syslog (310 MB) está cada dia maior e não á mais para vé-lo no modo texto, pois não fui que o fiz e é a 1º vez que estou tentando.

Meu arquivo /etc/rsyslog.conf está desta maneira por enquanto:

# /etc/rsyslog.conf Configuration file for rsyslog v3.
#
# For more information see
# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html


#################
#### CENTREON SYSLOG ####
#################
$ModLoad MySQL
$ModLoad imudp
$UDPServerRun 514
$AllowedSender UDP, 127.0.0.1, 192.168.56.0/24
$ModLoad imtcp
$InputTCPServerRun 514
$AllowedSender TCP, 127.0.0.1, 192.168.56.0/24

#################

#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
#$ModLoad immark # provides --MARK-- message capability

# provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf


###############
#### RULES ####
###############

#
# First some standard log files. Log by facility.
#
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log

#
# Logging for the mail system. Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err

#
# Logging for INN news system.
#
news.crit /var/log/news/news.crit
news.err /var/log/news/news.err
news.notice -/var/log/news/news.notice

#
# Some "catch-all" log files.
#
*.=debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg *

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
# news.=crit;news.=err;news.=notice;\
# *.=debug;*.=info;\
# *.=notice;*.=warn /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility. To use it,
# you must invoke `xconsole' with the `-file' option:
#
# $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
# busy site..
#
daemon.*;mail.*;\
news.err;\
*.=debug;*.=info;\
*.=notice;*.=warn |/dev/xconsole

# Configuration changes for Windows/Snare/Centreon-E2S logs
$EscapeControlCharactersOnReceive off

$template sysMysql,"INSERT INTO logs (host,facility, priority,level,tag,datetime,program,msg) VALUES ('%HOSTNAME%','%syslogfacility%','%syslogpriority%','%syslogseverity%','%syslogtag%', '%timereported:::date-mysql%', '%programname%', '%msg%')", SQL

*.* >127.0.0.1,syslog,syslogadmin,hamonlog;sysMysql



Muito obrigado,
Rafael.


Contribuir com comentário