Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
| technical:remote_syslog_setup [2025/06/11 04:28] – super_stunder | technical:remote_syslog_setup [2025/06/11 04:45] (current) – [Going against the Linux Gods] super_stunder | ||
|---|---|---|---|
| Line 90: | Line 90: | ||
| Here is a my / | Here is a my / | ||
| - | |||
| - | |||
| < | < | ||
| # / | # / | ||
| Line 153: | Line 151: | ||
| :msg, contains, " | :msg, contains, " | ||
| - | # Send all other messages to the journald socket | + | # Send all other messages to the journald socket |
| *.* action(type=" | *.* action(type=" | ||
| Line 175: | Line 173: | ||
| *.emerg : | *.emerg : | ||
| </ | </ | ||
| - | |||
| Line 222: | Line 219: | ||
| </ | </ | ||
| - | Here's my /etc/rsyslog.conf on the logger servers. | + | Once you have rsyslog configured and logging disabled going to journald you need to restart both logging services. |
| + | |||
| + | < | ||
| + | systemctl restart systemd-journald.service | ||
| + | systemctl restart rsyslog.service | ||
| + | </ | ||
| + | |||
| Alright I have the basics running now but need to address a couple of things. | Alright I have the basics running now but need to address a couple of things. | ||
| + | |||
| + | === The Syslog Server - syslog01 === | ||
| + | FIXME | ||
| + | |||
| + | Now you should see both servers " | ||
| + | < | ||
| + | 2025-06-11T04: | ||
| + | 2025-06-11T04: | ||
| + | </ | ||
| - < | - < | ||
| - Even though I have loaded RSYSLOG all logs are still going to the systemd logs. I want to keep the system logs pointed to systemd (let it do its thing) and have all of the firewalls logs sent to /var/log for text based processing. :!: I thought this was going to be an option, turns out log flexibility has gone away now that the world of Linux has push to systemd | - Even though I have loaded RSYSLOG all logs are still going to the systemd logs. I want to keep the system logs pointed to systemd (let it do its thing) and have all of the firewalls logs sent to /var/log for text based processing. :!: I thought this was going to be an option, turns out log flexibility has gone away now that the world of Linux has push to systemd | ||
| - | |||
| FIXME | FIXME | ||
| Line 240: | Line 252: | ||
| By implementing this iptables policy, a firewall that allows SSH on port 22, denies all other inbound traffic, and logs both accepted and denied packets with the desired prefix can be created. | By implementing this iptables policy, a firewall that allows SSH on port 22, denies all other inbound traffic, and logs both accepted and denied packets with the desired prefix can be created. | ||
| - | + | [[: | |