Eu tenho problemas para receber logs do roteador e de outros dispositivos após migrar do CentOS 6.8 para o CentOS 7.3. Você poderia, por favor, ajudar a dar uma olhada e me mostrar como corrigi-lo? Esses logs são muito importantes para mim, pois todos os meus trabalhos são baseados neles. Muito obrigado.
abaixo da informação FYI
[usuário @ host ~] $ rsyslogd -v
rsyslogd 7.4.7, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
Runtime Instrumentation (slow code): No
uuid support: Yes
[usuário @ host ~] $ cat / etc / centos-release
CentOS Linux release 7.3.1611 (Core)
[usuário @ host ~] # ll -dZ / var / log / usb
drwxr-xr-x. root root system_u:object_r:var_log_t:s0 /var/log/usb
[usuário @ hosts ~] # nc -vu 192.168.0.111 514
Ncat: Version 6.40 ( http://nmap.org/ncat )
Ncat: Connected to 192.168.0.111:514.
[usuário @ host ~] # nc -vu 192.168.0.1 514
Ncat: Version 6.40 ( http://nmap.org/ncat )
Ncat: Connected to 192.168.0.1:514.
[usuário @ host ~] $ ip rota sh
default via 192.168.0.1 dev enp3s0 proto static metric 100
192.168.0.0/24 dev enp3s0 proto kernel scope link src 192.168.0.111 metric 100
192.168.2.0/24 dev enp0s20u2c2 proto kernel scope link src 192.168.2.113 metric 100
[usuário @ host ~] # journalctl --unit = rsyslog
-- Reboot --
Jan 07 01:46:49 host systemd[1]: Starting System Logging Service...
Jan 07 01:46:49 host systemd[1]: Started System Logging Service.
/etc/rsyslog.conf (somente descomente)
$ModLoad imuxsock
$ModLoad imjournal
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerAddress 192.168.0.111
$UDPServerRun 514
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
/etc/rsyslog.d/networklog.conf
$template router, "/var/log/usb/router/router.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.0.1" -?router
& ~
$template nas, "/var/log/usb/qnap/qnap.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.0.110" -?nas
& ~
$template switch, "/var/log/usb/switch/switch.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.0.2" -?switch
& ~
$template bridge, "/var/log/usb/bridge/bridge.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.5.3" -?bridge
$ ~
$template ap, "/var/log/usb/ap/ap.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.0.4" -?ap
$ ~
/ etc / sysconfig / iptables
# Generated by iptables-save v1.4.7 on Tue Jul 28 19:40:14 2015
*filter
#:INPUT ACCEPT [229:17291]
#:FORWARD ACCEPT [0:0]
#:OUTPUT ACCEPT [133:14088]
# ssh daemon
-A INPUT -p tcp -i enp0s20u2c2 -d 192.168.2.113 -m state --state NEW,ESTABLISHED,RELATED -m tcp --dport 22 -j ACCEPT
# syslog daemon
-A INPUT -i enp3s0 -d 192.168.0.111 -p udp -m state --state NEW,ESTABLISHED,RELATED -m udp --dport 514 -j ACCEPT
-A OUTPUT -o enp3s0 -s 192.168.0.111 -p udp -m state --state NEW,ESTABLISHED,RELATED -m udp --sport 514 -j ACCEPT
# default DROP rule
-A INPUT -j DROP
COMMIT
# Completed on Tue Jul 28 19:40:14 2015
[scripts de rede do usuário @ host] # cat ifcfg-enp3s0
TYPE=Ethernet
BOOTPROTO=static
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=enp3s0
UUID=6201e661-dfc9-4c1a-aad9-3fc1330d79e4
DEVICE=enp3s0
ONBOOT=yes
IPADDR=192.168.0.111
PREFIX=24
GATEWAY=192.168.0.1
DNS1=8.8.8.8
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes
IPV6_PRIVACY=no
ola eu sou abridor de discussão.
descobriu que o CentOS 6.8 e o CentOS 7.3 vêm com uma versão diferente do rsyslogd parece que meu antigo código conf não funciona com o rsyslog 7 há muitos conf de amostra na internet para começar.
Para iniciar a depuração desabilite o rsyslog usando service ou systemctl e edite abaixo os comandos
/path/to/rsyslogd -N 1 ##### check conf syntax
/path/to/rsyslogd -dn ##### run in debug mode
Obrigado