Agenda: log-management-syslog-ng.txt

File log-management-syslog-ng.txt, 1.5 KB (added by nocadmin, 9 years ago)

Syslog-ng Exercises

Line 
1Advanced Registry Operations Curriculum
2
3Using syslog-ng
4
51. Install syslog-ng
6
7        # apt-get install syslog-ng
8
92. Edit /etc/syslog-ng/syslog-ng.conf
10
11Find the lines:
12
13        # (this is equivalent to the "-r" syslogd flag)
14        # udp();
15
16and change it to:
17
18        # (this is equivalent to the "-r" syslogd flag)
19        udp();
20
21At the bottom of the file, add:
22
23filter f_routers { facility(local5); };
24log {
25        source(s_all);
26        filter(f_routers);
27        destination(routers);
28};
29destination routers {
30 file("/var/log/network/$YEAR/$MONTH/$DAY/$HOST-$YEAR-$MONTH-$DAY-$HOUR.log"
31 owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)
32 template("$YEAR $DATE $HOST $MSG\n"));
33};
34
353. Create the directory /var/log/network/
36
37        # mkdir /var/log/network/
38
394. Restart syslog-ng:
40
41        # /etc/init.d/syslog-ng restart
42
435. Configure your virtual routers to send syslog messages to your server:
44
45        (Note: since you are working with 1 router / multiple TLDs, you will need
46        to configure your router send to multiple hosts:
47
48        Hint: Use rancid clogin!
49
50        rtrX# config terminal
51        rtrX(config)# logging tld1
52        rtrX(config)# logging tld2
53        rtrX(config)# logging facility local5
54        rtrX(config)# logging userinfo
55        rtrX(config)# exit
56        rtrX# write
57        ...
58        rtrX# copy running-config flash:running-config
59
60        logout from the router (exit)
61
626. On your PC, See if messages are starting to appear under
63
64        /var/log/network/2010/02/26/...
65
667. If not, try to login back into the router, and run some "config" commands,
67   then logout.