rsyslogサーバを作る

rsyslog.confの設定を変更する

# vi /etc/rsyslog.conf

# Provides UDP syslog reception

$ModLoad imudp

$UDPServerRun 514

# Provides TCP syslog reception

$ModLoad imtcp

$InputTCPServerRun 514

# 送信元を限定設定の追加

# Sender

$AllowedSender UDP, 127.0.0.1, 192.168.1.0/24

$AllowedSender TCP, 127.0.0.1, 192.168.1.0/24

設定が終了したら、Firewalldの設定を変更と、rsyslogdの再起動
# firewall-cmd --permanent --add-port=514/tcp # firewall-cmd --permanent --add-port=514/udp # firewall-cmd --reload # systemctl restart rsyslog

syslogクライアント側の設定

# vi /etc/rsyslog.conf

# ### begin forwarding rule ###

# The statement between the begin ... end define a SINGLE forwarding

# rule. They belong together, do NOT split them. If you create multiple

# forwarding rules, duplicate the whole block!

# Remote Logging (we use TCP for reliable delivery)

#

# An on-disk queue is created for this action. If the remote host is

# down, messages are spooled to disk and sent when it is up again.

$ActionQueueFileName fwdRule1 # unique name prefix for spool files

$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)

$ActionQueueSaveOnShutdown on # save messages to disk on shutdown

$ActionQueueType LinkedList   # run asynchronously

$ActionResumeRetryCount -1    # infinite retries if host is down

# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional

*.* @192.168.1.10:514

*.* @@192.168.1.10:514

# systemctl restart rsyslog

syslogデータは　/var/log/messages に保存される。
これだと、ログが混在してしまうので、IPアドレス毎に分離する。
以下の2行を追加。

# vi /etc/rsyslog.conf
$template ClinetMessage,"/var/log/rsyslog/%fromhost%/messages.log"
*.* -?ClinetMessage

さらに日ごとに分けるなら、/var/log/rsyslog以下を
/var/log/rsyslog/%fromhost%/%$year%%$month%%$day%_messages.log
とする。