Montar un servidor de logs con rsyslog
Editamos el fichero /etc/rsyslog.conf en el servidor y descomentamos estas líneas, o solo la del protocolo que queramos usar, TCP o UDP.
# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")
# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")
Ahora añadimos esta linea, definiendo la ruta donde queremos ver los logs de los clientes.
## Client logs files
$template RemoteLogs,"/root/rsyslog/%HOSTNAME%/%PROGRAMNAME%.log"
*.* ?RemoteLogs
Guardamos los cambios y reiniciamos el servicio rsyslog
systemctl restart rsyslog
Comprobamos si se ha reiniciado correctamente
systemctl status rsyslog
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2023-05-26 13:14:37 CEST; 10s ago
TriggeredBy: ● syslog.socket
Docs: man:rsyslogd(8)
man:rsyslog.conf(5)
https://www.rsyslog.com/doc/
Main PID: 65551 (rsyslogd)
Tasks: 10 (limit: 2204)
Memory: 1.1M
CPU: 27ms
CGroup: /system.slice/rsyslog.service
└─65551 /usr/sbin/rsyslogd -n -iNONE
May 26 13:14:37 RasPi systemd[1]: Starting System Logging Service...
May 26 13:14:37 RasPi rsyslogd[65551]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [
v8.2102.0]
May 26 13:14:37 RasPi rsyslogd[65551]: [origin software="rsyslogd" swVersion="8.2102.0" x-pid="65551" x-info="https://www.r
syslog.com"] start
May 26 13:14:37 RasPi systemd[1]: Started System Logging Service.
Ahora configuramos los clientes, añadimos esta linea poniendo la IP del servidor donde tenemos el rsyslog y reiniciamos el servicio.
*.* @IP_SERVER_RSYSLOG:514
Ahora podremos ver en la ruta definida como los clientes empiezan a mandar los logs, ordenados por cliente y servicios
root@RasPi:~/rsyslog# ll
total 12
drwx------ 2 root root 4096 May 26 12:36 nanoPiDNS
drwx------ 2 root root 4096 May 25 14:17 RT-AX88U_Pro
drwx------ 2 root root 4096 May 26 01:06 antminer_l3+
root@RasPi:~/rsyslog# ls -l RT-AX88U_Pro/
total 460
-rw-r--r-- 1 root root 74 May 25 14:16 BONDING.log
-rw-r--r-- 1 root root 228 May 25 14:16 BWDPI.log
-rw-r--r-- 1 root root 237 May 25 14:16 FTP_Server.log
-rw-r--r-- 1 root root 92 May 25 14:16 "Let's_Encrypt.log"
-rw-r--r-- 1 root root 133 May 25 14:16 Mastiff.log
-rw-r--r-- 1 root root 158 May 25 14:16 RT-AX88U_Pro.log
-rw-r--r-- 1 root root 668 May 25 14:17 Samba_Server.log
-rw-r--r-- 1 root root 240 May 25 14:16 Timemachine.log
-rw-r--r-- 1 root root 182 May 25 14:16 WAN_Connection.log
-rw-r--r-- 1 root root 164 May 25 14:15 WEBDAV_Server.log
-rw-r--r-- 1 root root 11883 May 26 13:07 acsd.log
-rw-r--r-- 1 root root 5765 May 25 14:16 avahi-daemon.log
-rw-r--r-- 1 root root 180 May 25 14:17 awsiot.log
-rw-r--r-- 1 root root 361 May 25 14:16 cfg_server.log
-rw-r--r-- 1 root root 105 May 25 14:17 crond.log
-rw-r--r-- 1 root root 260 May 25 14:16 ddns.log
-rw-r--r-- 1 root root 282 May 25 14:16 disk_monitor.log
-rw-r--r-- 1 root root 91743 May 26 12:58 dnsmasq-dhcp.log
-rw-r--r-- 1 root root 161 May 25 14:16 dnsmasq-script.log
-rw-r--r-- 1 root root 12840 May 26 01:18 dnsmasq.log
-rw-r--r-- 1 root root 529 May 26 01:47 dropbear.log
-rw-r--r-- 1 root root 93 May 25 14:15 haveged.log
-rw-r--r-- 1 root root 85114 May 26 13:16 hostapd.log
-rw-r--r-- 1 root root 112 May 25 14:16 hotplug.log
-rw-r--r-- 1 root root 82 May 25 14:16 hour_monitor.log
-rw-r--r-- 1 root root 188 May 25 14:16 httpd.log
-rw-r--r-- 1 root root 225 May 25 14:16 iTunes.log
-rw-r--r-- 1 root root 353 May 25 14:16 inadyn.log
-rw-r--r-- 1 root root 122 May 25 14:16 init.log
-rw-r--r-- 1 root root 6295 May 25 17:41 kernel.log
-rw-r--r-- 1 root root 95 May 25 14:16 lldpcli.log
-rw-r--r-- 1 root root 1580 May 25 14:16 lldpd.log
-rw-r--r-- 1 root root 972 May 25 14:16 networkmap.log
-rw-r--r-- 1 root root 209 May 25 14:16 ntpd.log
-rw-r--r-- 1 root root 17049 May 26 02:32 ovpn-server1.log
-rw-r--r-- 1 root root 1866 May 25 14:16 pppd.log
-rw-r--r-- 1 root root 1863 May 26 01:18 rc_service.log
-rw-r--r-- 1 root root 75 May 25 14:16 roamast.log
-rw-r--r-- 1 root root 1002 May 26 01:18 stubby.log
-rw-r--r-- 1 root root 103 May 25 14:16 usb.log
-rw-r--r-- 1 root root 81 May 25 14:16 wan.log
-rw-r--r-- 1 root root 58834 May 26 12:35 wlceventd.log
-rw-r--r-- 1 root root 906 May 25 14:17 wsdd2.log
-rw-r--r-- 1 root root 87 May 25 14:17 zcip_client.log
