J368P


## REMOTE LOGGING USING RELIABLE SYSTEM LOGGING DAEMON
------------------------------------------------------

Three syslog daemons in Linux:

  syslog (1980), syslog-ng (1998), rsyslog (2004)
 
RSysLog can be configured to start as
 
  + server
  + client
  + client and server at the same time
  
Rsyslog supports three different configuration formats (“languages”): obsolete, basic, RainerScript [5]


# SOME SYNTAX

Found inside Debian Stretch's /etc/rsyslog.conf

  #### RULES ####
  ###############

  #
  # First some standard log files.  Log by facility.
  #
  auth,authpriv.*                 /var/log/auth.log
  *.*;auth,authpriv.none          -/var/log/syslog
  cron.*                          /var/log/cron.log
  daemon.*                        -/var/log/daemon.log
  kern.*                          -/var/log/kern.log
  lpr.*                           -/var/log/lpr.log
  mail.*                          -/var/log/mail.log
  user.*                          -/var/log/user.log
  
Notes while trying to read this:

Facility means object: kern, lpr, mail,.. etc.

Detected language is Basic Script, not RainerScript yet. Definitely, belongs to declarative branch, based on filtering rules. 

(Personal notes: Remainds me iptables somehow. Language as a whole is huge enough. RainerScript is a Declarative + Imperative hybrid. Before Microsoft people "boldly go" to XAML and C#LINQ, such mixtures were avoided..)

auth,authpriv.*
    matches all messages from the auth or authpriv facilities.
    
*.*;auth,authpriv.none
    matches all messages from all facilites, but excluding any from auth or authpriv.
    
mail.info
    matches messages from the mail facility with security levels of 'info' or higher.
    
mail.warn
    matches messages from the mail facility with security levels of 'warn' or higher.
    
*.=debug;
    matched messages from all facilities with the 'debug' security level and no other.
    
By default, the log file is synchronized every time a syslog message is generated. Use a dash mark (-) as a prefix of the file path you specified to omit syncing [6]:

  FILTER -PATH
  
With versions prior to rsyslog 7, the tilde character (~) was used instead of 'stop' to discard syslog messages [6]. (See [4] for "..we don't really need that many copies of every log entry").

2. The Linux rsyslog also allows has some special characters, such as = or !, which can be prefixed to priority levels to indicate “this priority only” for equal sign and “not this priority or higher than this”.

Some samples of Rsyslog priority level qualifiers:

    kern.info = kernel logs with info priority and higher.
    kern.=info = only kernel messages with info priority.
    kern.info;kern.!err = only kernel messages with info, notice, and warning priorities.
    kern.debug;kern.!=warning = all kernel priorities except warning.
    kern.* = all kernel priorities messages.
    kern.none = don’t log any related kernel facility messages regardless of the priority.

For instance, assuming you want to send only a specific facility messages to a remote log server, such as all related mail messages regardless of the priority level, add the below line to rsyslog configuration file:

  mail.* @10.0.10.1:514

Now read [1] and [2].


# ToDo

Send from 10.0.10.* all log messages to Gateway [10.0.10.1]. Send Apache errors from 10.0.10.30 (Configure one box behind NAT to use Static IP).


# LINKS

Google: remote rsyslog

  1. How to configure remote logging with rsyslog
  
    https://access.redhat.com/solutions/54363
    
  2. How to Setup Rsyslog Client to Send Logs to Rsyslog Server in CentOS 7
  
    https://www.tecmint.com
      /setup-rsyslog-client-to-send-logs-to-rsyslog-server-in-centos-7/

  3. https://www.thegeekdiary.com
      /understanding-the-etc-rsyslog-conf-file-for-configuring-
      system-logging/
      
  4. https://www.the-art-of-web.com/system/rsyslog-config/

  5. https://www.rsyslog.com/doc/v8-stable
        /configuration/conf_formats.html
        
  6. https://access.redhat.com/documentation/en-us
        /red_hat_enterprise_linux/7/html/system_administrators_guide
        /s1-basic_configuration_of_rsyslog
        
  7. What is the difference between syslog, rsyslog and syslog-ng?
  
    https://serverfault.com/questions/692309
      /what-is-the-difference-between-syslog-rsyslog-and-syslog-ng