How to configure linux syslog server step by step guide Example and Implementation

Sample Exam question:- You are a System administrator. Using Log files very easy to monitor the system. Now there are 40 servers running as Mail, Web, Proxy, DNS services etc. Your task is to centralize the logs from all servers into on LOG Server. How will you configure the LOG Server to accept logs from remote host ?

per quest of log server

A linux server with ip address 192.168.0.254 and hostname Server A linux client with ip address 192.168.0.1 and hostname Client1 Updated /etc/hosts file on both linux system Running portmap and xinetd services Firewall should be off on server

necessary configuration for log server

We suggest you to review that article before start configuration of log server. Once you have completed the necessary steps follow this guide.

Check syslog, portmap, xinetd service in system service it should be on

 #setup Select System service from list [*]portmap [*]xinetd [*]syslog

Now restart xinetd and portmap service To keep on these services after reboot on then via chkconfig command After reboot verify their status. It must be in running condition

Now open the /etc/sysconfig/syslog file and locate SYSLOGD_OPTIONS tag add -r option in this tag to accepts logs from clients

-m 0 disables 'MARK' messages. -r enables logging from remote machines -x disables DNS lookups on messages recieved with -r

After saving file restart service with service syslog restart command

On Linux client

ping from log server and open /etc/syslog.conf file Now go to the end of file and do entry for serve as user.* @ [ server IP] as shown in image After saving file restart service with service syslog restart command

Now restart the client so it can send log entry to server. ( Note that these logs will generate when client boot, so do it restart not shutdown)