Linux syslog

Location: /var/log

Service: syslog (service syslog {start|stop|status|restart})

Config file: /etc/sysconfig/syslog

Level: DEBUG --> INFO --> NOTICE --> WARNING --> ERR --> CRIT --> ALERT --> EMERG

Content: AUTH / AUTHPRIV / CRON / DAEMON / FTP / KERN / LOCAL0~LOCAL7 / LPR / MAIL / NEWS / SYSLOG / USER / UUCP

Process: 

1. rsyslogd: all system log (RHEL6)

syslogd: system related log (RHEL5)

Config file: /etc/rsyslog.conf (RHEL6)

Config file: /etc/syslog.conf (RHEL5)

2. klogd: kernel related log(RHEL5)

/var/log/secure: user account

/var/log/messages: normal operation

/var/log/xferlog: ftp log (only record the operation: put, get)

Check the success log record: last

related file: /var/log/wtmp

Check the fail log record: lastb

related file: /var/log/btmp

Setting Example

1. Write all error log into one file

A. modify /etc/rsyslog.conf

Add:

*.err    /var/log/allerror

B. restart syslog service: service syslog restart

2. Write all ssh login log

A. modify /etc/hosts.allow

Add:

sshd : ALL : spawn echo "%a access you %A `date +%y%m%d%t`" >> /var/log/sshaccess

Tomcat Application Log4j Log Centralized Manage

Environment

Tomcat Application server: Windows Server 2003 

Log server: CentOS 6.5

Configuration

Log server

/etc/rsyslog.conf

1. uncomment following line:

$ModLoad imudp

$UDPServerRun 514

$ModLoad imtcp

$InputTCPServerRun 514

2. define location:

local2.info     /var/log/login_info.log

3. Restart rsyslog service: service rsyslog restart

4. Add iptables policy and restart iptables service:

-A INPUT -m state --state NEW -m udp -p udp --dport 514 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 514 -j ACCEPT

Tomcat Application Server

192.168.204.10

1. Add following context into C:\TomcatThor\webapps\TheShelter-MyJournal\WEB-INF\classes\log4j.xml

<appender name="syslog" class="org.apache.log4j.net.SyslogAppender"> 

<errorHandler/>

<param name="Facility" value="local2"/>

<param name="FacilityPrinting" value="false"/>

<param name="Header" value="true"/>

<param name="Threshold" value="INFO"/>

<param name="SyslogHost" value="192.168.204.12"/>

<param name="ConversionPattern" value="%d %-5p %X{sessionId} %c{1} - %m%n"/>

</appender>

2. Change the following context

From 

<category name="AccessLog" additivity="false">

<priority value="info"/>

<appender-ref ref="accessFile"/>

</category>

To

<category name="AccessLog" additivity="false">

<priority value="info"/>

<appender-ref ref="accessFile"/>

<appender-ref ref="syslog"/>

</category>

3. Restart TomcatThor service