0

I'm consolidating the client logs to a centralized server in Ubuntu using the rsyslog deamon. While consolidating the logs, how can i see the amount of network traffic or file size transferred from the client to server?

Is there any way i can do filtering from the client machine before transferring the logs to server?

1 Answer 1

0

Forwarding only selected messages is easy. Put a file with the extension *.conf in /etc/rsyslog.d. Name it e.g. /etc/rsyslog.d/40-forwarder.conf to have it read before the defaults (in 50-default.conf) or /etc/rsyslog.d/60-forwarder.conf to have it read after the defaults:

if ( ($programname == "my-binary") or ($syslogfacility-text == "local1") ) then {
    action(type="omfwd" target="my.syslog.server" port="514")
}

This will forward all mesages with the given properties to host my.syslog.server, UDP port 514. If you put stop after the action, then no further processing is done for that message.

This means: if you name the file 40-....conf and add stop:

if ( ($programname == "my-binary") or ($syslogfacility-text == "local1") ) then {
    action(type="omfwd" target="my.syslog.server" port="514")
    stop
}

then the default actions for these messages (like writing them to /var/log/messages) will not take place.

As for you other question about network traffic: That is actually another question and should be posted separately.


Update

The condition

if ( ($programname == "my-binary") or 
     ($syslogfacility-text == "local1") ) then {…}

is just an example for a filter. Probably you have some other criteria to select the messages that should be forwarded to the centralized logging host.

In this case only those logmessages that were written to the logfacility local1 or were issued by some program called my-binary would be forwarded. All others whould not. You can test the filter with logger (the -t switch mimicks the program name):

logger -t my-binary    -plocal4.info "This is forwarded ($RANDOM)"
logger -t other-binary -plocal1.info "This is forwarded ($RANDOM)"
logger -t other-binary -plocal4.info "This is NOT forwarded ($RANDOM)"

On the remote host, the first two messages should appear, but not the last.

You didn't say what kind of filter should be applied, so I chose an arbitrary criteria.

See Filter Conditions and RainerScript for further information on what is possible with rsyslog.

8
  • In the above *conf file, can you explian $programname == "my-binary" and $syslogfacility-text == "local1". Nov 16, 2018 at 5:09
  • @JasirBinSiddique See the updated answer. You asked whether it is possible to filter the messages before they are sent to the server. This is just an example of a filter which you must adapt to your needs.
    – PerlDuck
    Nov 16, 2018 at 9:37
  • @PerlDuck-I want to forward filtered FTP authentication related logs, and SSH logs into syslog file in centralized server. How can i do the filtering? How can i create a single log file in consolidated server for FTP logs where logs are coming from different nodes or client? Nov 16, 2018 at 11:30
  • I'm using Ubuntu 18.04 Nov 16, 2018 at 11:36
  • @JasirBinSiddique For ssh I'd try $programname == "sshd", maybe $syslogfacility-text == "auth" and/or $syslogfacility-text == "authpriv". For ftp exists a facility with the same name: $syslogfacility-text == "ftp" could work if your FTP server uses that facility.
    – PerlDuck
    Nov 16, 2018 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.