[rsyslog-notify] Forum Thread: Re: Forward log TCP/UDP - (Mode 'reply')

[noreply at adiscon.com]

User: Teddy.78 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24813#p24813

Message: 
----------
Ok if you really want :

[b:16hi3xin]Main rsyslog :[/b:16hi3xin]
/etc/rsyslog.conf:
[code:16hi3xin]

#################
#### MODULES ####
#################

module (load="imuxsock") # provides support for local system logging
module (load="imklog")   # provides kernel logging support

#Provides the ability to parse && normalize syslog messages
module(load="mmjsonparse")
module(load="mmnormalize")

module(load="omrelp")

#provides RELP reception for the customer perimeter
module(load="imrelp")
input(type="imrelp" port="10514")

#provides UDP syslog reception for the AA Cloud perimeter
module(load="imudp")
input(type="imudp" port="514")

module(load="imtcp")
input(type="imtcp" port="10515") #That permit receive in TCP from the slave
rsyslog
###########################
#### GLOBAL DIRECTIVES ####
###########################

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

$WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

###################
### LOCAL RULES ###
###################

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
cron.*                          /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log

mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err

news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice

*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages

*.emerg                         :omusrmsg:*

daemon.*;mail.*;\
        news.err;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       |/dev/xconsole
[/code:16hi3xin]

[b:16hi3xin]Slave rsyslog :[/b:16hi3xin]
/etc/rsyslog.conf:
[code:16hi3xin]#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support

#module de sortie RELP
module(load="omrelp")

#UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")


###########################
#### GLOBAL DIRECTIVES ####
###########################

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

$WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

###############
#### RULES ####
###############

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log
local7.*                        /var/log/sftp.log

mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err

news.crit                       /var/log/news/news.crit
news.err                        /var/log/news/news.err
news.notice                     -/var/log/news/news.notice

*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages

*.emerg                         :omusrmsg:*

daemon.*;mail.*;\
        news.err;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       |/dev/xconsole
[/code:16hi3xin]

/etc/rsyslog.d/0client.conf:
[code:16hi3xin]###TEMPLATE###
template (name="client1" type="string"
string="/syslog/Client1/%HOSTNAME%/%syslogfacility-text%.log")

###PROCESSING###
#Write remote client ASA logs to local file & #Send remote client ASA logs
to remote syslog server

if ( $fromhost-ip == "ip_client" ) then
        action ( type="omfile" Dynafile="client1")
        & action (type="omfwd" Target="ip_main_syslog" Port="10515"
Protocol="tcp")
        & stop
[/code:16hi3xin]

One log:
[code:16hi3xin]Aug  8 06:25:01 SLAVESYSLOG rsyslogd:
[origin software="rsyslogd" swVersion="5.8.11" x-pid="28524"
x-info="http://www.rsyslog.com"] rsyslogd was HUPed
[/code:16hi3xin]