Red Hat Enterprise Linux Diagnostics and Troubleshooting

Instructions

Configure the rsyslog service on servera to serve as a central log host. For more reliable syslog messages delivery, configure the central log host to accept messages from remote hosts using TCP.

Create a rule to organize syslog messages into subdirectories under /var/log/loghost. Create subdirectories by using the originating host name of each syslog message. Within each subdirectory, maintain a separate log file for each syslog facility. Configure log rotation for the new log files.

Configure serverb for remote logging to the central log host. Test the configuration by generating syslog messages from serverb. Verify that the generated messages are routed to the appropriate log file on servera.

1. Log in to servera and switch to the root user.

   [student@workstation ~]$ ssh student@servera
   ...output omitted...
   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]#

2. Verify that the rsyslog service is running and enabled to start at boot.

   [root@servera ~]# systemctl is-active rsyslog
   active
   [root@servera ~]# systemctl is-enabled rsyslog
   enabled

3. Configure the rsyslog service on servera to accept remote syslog messages with TCP, and that the messages are written to separate files that are named for the originating host and message facility.

   1. Enable TCP syslog reception in /etc/rsyslog.conf by uncommenting these lines in /etc/rsyslog.conf.

      module(load="imtcp")
      input(type="imtcp" port="514")

   2. In the "#### RULES ####" section, add a template() statement to organize log messages by host name and syslog facility. Below the template() statement, create a rule to apply the template to all syslog messages.

      template(name="ExerciseTemplate" type="string"
               string="/var/log/loghost/%HOSTNAME%/%syslogfacility-text%.log")
      *.* action(type="omfile" DynaFile="ExerciseTemplate")

      Note

      A template() statement can span multiple lines for readability, if the statement's parameters are contained within the () parentheses.

   3. To apply the configuration changes, restart the rsyslog service.

      [root@servera ~]# systemctl restart rsyslog

4. Add this entry to the /etc/logrotate.d/syslog file to add the new log files to the log rotation schedule.

   /var/log/loghost/*/*.log

5. Modify the servera firewall to allow receiving incoming syslog messages from remote hosts on TCP port 514.

   1. Allow incoming packets on TCP port 514.

      [root@servera ~]# firewall-cmd --add-port=514/tcp --permanent
      success

   2. To apply the change, reload firewalld.

      [root@servera ~]# firewall-cmd --reload

6. From workstation, open a new terminal. Login to serverb and switch to the root user.

   [student@workstation ~]$ ssh student@serverb
   ...output omitted...
   [student@serverb ~]$ sudo -i
   [sudo] password for student: student
   [root@serverb ~]#

7. Configure serverb to send syslog messages remotely to servera with the TCP protocol.

   1. Create this rule in /etc/rsyslog.conf to send syslog messages to servera with TCP port 514.

      *.* action(type="omfwd" target="servera" port="514" protocol="tcp")

   2. To apply the change, restart the rsyslog service on serverb.

      [root@serverb ~]# systemctl restart rsyslog

8. Verify that remote logging from serverb to the central log host on servera is working.

   1. On serverb, generate some syslog messages that use different facilities.

      [root@serverb ~]# logger -p user.info "Test user.info message from serverb"
      [root@serverb ~]# logger -p cron.crit "Test cron.crit message from serverb"

   2. On servera, verify that the syslog messages routed to the correct files in the /var/log/loghost/serverb directory.

      [root@servera ~]# grep 'user\.info' /var/log/loghost/serverb/user.log
      Dec 11 00:44:09 serverb root: Test user.info message
      [root@servera ~]# grep 'cron\.crit' /var/log/loghost/serverb/cron.log
      Dec 11 00:44:40 serverb root: Test cron.crit message

9. Close the additional terminal session to serverb and return to workstation as the student user.

   [root@servera ~]# exit
   [student@servera ~]$ exit
   [student@workstation ~]$