ryzhov_al

ß âûáðàë NAS â êà÷åñòâå öåíòðàëèçîâàííîãî õðàíèëèùà ëîãîâ, íà NAS'å ðàáîòàåò âàíèëüíûé Debian 7. Íà ðîóòåðå äîñòàòî÷íî óêàçàòü ip-àäðåñ óäàë¸ííîãî ëîã-ñåðâåðà, à íà Debian:

à) ðàñêîìåíòèðîâàòü â ôàéëå /etc/rsyslog.conf ñòðî÷êè:

Code:

$ModLoad imudp
$UDPServerRun 514

á) ñîçäàòü ôàéë/etc/rsyslog.d/per-host.conf ñî ñëåäóþùèì ñîäåðæèìûì:

Code:

$template FILENAME,"/var/log/%fromhost-ip%-syslog"

if ($fromhost-ip != '127.0.0.1') then ?FILENAME
& ~

â) ïåðåçàïóñòèòü ñåðâèñ, ÷òîáû íàñòðîéêè âñòóïèëè â ñèëó:

Code:

sudo /etc/init.d/rsyslog restart

Ïðàâèëî, ñîçäàííîå â ïóíêòå «á» ïîçâîëèò ñêëàäûâàòü â ïàïêó /var/log ñèñòåìíûå ëîãè óäàë¸ííûõ ìàøèí â îòäåëüíûå ôàéëû ñ èìåíàìè <remote ip>-syslog. Çà ðîòàöèåé ëîãîâ Debian áóäåò ñëåäèòü ñàì. Ïîñëåäíÿÿ ñòðî÷êà «& ~» îáðûâàåò äàëüíåéøóþ îáðàáîòêó óäàë¸ííûõ ëîãîâ ëîêàëüíûìè ïðàâèëàìè, ñëåäñòâåííî, íèêàêàÿ óäàë¸ííàÿ èíôîðìàöèÿ íå ïîïàä¸ò â ôàéëû /var/log/{messages,kern.log,daemon.log,auth.log}.

Âñ¸!