--=========準備========

1.firewall狀態檢查

firewall-cmd --state

2.停止和禁用

systemctl stop firewalld.service

systemctl disable firewalld.service

3.檢查服務

systemctl status firewalld.service

4.檢查iptables

systemctl status iptables.service

systemctl stop iptables.service

--==========配置=========

1.打開配置文件

vim /etc/rsyslog.conf

2.啟用rsyslog從UDP 514端口接收日志

$ModLoad imudp

$UDPServerRun 514

3.啟用rsyslog從TCP 514端口接收日志

$ModLoad imtcp

$InputTCPServerRun 514

4.創建一個日志接收模板

在GLOBAL DIRECTIVES塊前，加入

$template RemoteLogs,"/var/log/%HOSTNAME%/%PROGRAMNAME%.log" *

*.*? ?RemoteLogs

備注：

The "& ~" sign represents a redirect rule, and is used to tell rsyslog daemon to stop processing log messages further, and not write them locally. If this redirection is not used, all the remote messages would be also written on local log files besides the log files described above, which means they would practically be written twice. Another consequence of using this rule is that the syslog server's own log messages would only be written to dedicated files named after machine's hostname.

加入規則：

#記錄所有日志類型的info級別以及大于info級別的信息，但是mail郵件信息，authpriv驗證方面的信息和cron時間任務相關的信息除外

*.info,mail.none,authpriv.none,cron.none??? ?RemoteLogs

5.

systemctl restart rsyslog

6.

netstat -tulpn | grep rsyslog

總結

以上是生活随笔為你收集整理的Linux7添加syslog,在CentOS 7.2上使用rsyslog配置syslog server的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。