[No audio]
Central logger is a server that
acts as a server and it receives all the
logs from every server, every clients
that are out there to receive the
logging information. The purpose of this
server is to generate logs within its
own self, which manages all the logs in
/var/log directory. And also, if it is,
built to receive all the logs, then
it could work as a central logger. And
the reason we call central logger is
because it is a central location, just
like you'll see a lot of a lot of names
like grand central or central location,
anything that is centrally located to
receive all incoming traffic, whether it
is trains, or airplanes, or buses, you
will most likely hear the word Central,
along with the name of his actual
location. So in our Linux environment,
we have the server called central
logger, and it has a service that runs
within that server, it's called rsyslog.
And the name of the service or
the package is rsyslog. It is not, it
does not have a d at the end. But it's
just, it's just something that you
have to get used to it. I don't know why
it does not have d, some of the service
has it, some of them services don't. But
that's okay, there's something you
just have to live with. Configuration
file is located in /etc/syslog.conf
file. This is where you go in and change
the parameters if you have to. And the
service to start or stop its exact syntax
would be systemctl restart rsyslog.
And to enable it at boot time,
which means every time you reboot your
system, you want this service to be up
and running along with the system. So
you enable it. Picture speaks 1000
words, so that's why I have this
picture on the right hand side. If you
see in the middle, we have the server
which is acting as a central logger. It
receives all the traffic from all other
servers. Those servers could be any,
it's not specifically, a server could be
a modem, it could be a Windows machine,
it could be a Linux machine, it could be
a printer, you could have any of those
devices configured to send this log
traffic to one server. Now the good
question is, why do we need rsyslog
server or central logger? Well ask
yourself if you are working in an
environment where there are 1000
servers, and you having issues with
servers every now and then, sometimes
three servers, sometimes 10 servers,
sometimes 100 servers, are you actually
going to go log into every server one by
one and check the logs to see which
system is having issue and where
actually the problem is happening. Of
course not right, because it's tedious
task. You don't want to waste your time
there, you're productive person. So you
want to make your life much easier,
you want to make your system more
efficient. So that's when you create the
central logger. So let's go into our
Linux machine, I have a PuTTY session
open. And I will go straight into the
PuTTY session of my machine. I'll just
make sure I am root because you have to
be root to go in and modify those files.
The first thing you have to do is check
if you have that package installed for
rsyslog. And to do that the command
is rpm -qa, which will list every
packages installed in your system. And
the reason we use grep is because we
don't want to list every package that's
out there, we are just concerned
about rsyslog package. And you run it,
and you do get that information that
you're looking for, excluding all other
packages that you don't really care
about at this point. So you have the
package perfect. If you did not have
that package, you would have to run yum,
install rsyslog, and it will install
the package as long as you have internet
connection and it goes to
CentOS or any Redhat repository. Now
the configuration file is /etc/rsyslog.conf file, sorry, in my
configuration file on my slide I missed
r, it's just a misspelling, I'll fix it.
So the the file is /etc/rsyslog.conf.
And when you go in there, you hit enter.
And anything you see again that starts
with hash, you can ignore it. Some of
the parameters are by default has been
commented out. If you want to have it
enabled, if you want the traffic, UDP
traffic, or any of the traffic coming in,
you have to take out this hash sign in
front of it. So the parameter will be
enable. The one that we are really
concerned about is all the way at the
end, which one is right here starts with
hash, you will have to take it out. If
you are sending your system, this is
your system, if you are sending this
system logs to another central logger,
you will specify the name, the hostname
or the IP address of that central
logger. This is the port 514. By
default, rsyslog communication takes
place on port 514. Just like any other
services, like DNS talks on port 53, and
there are many other services like NTP
talks, I believe 123, just like that,
every service has an associated port to
it and it will talk only on that port.
So you save it if you want to comment
that out. And then once you have it
saved, you know you're sending your
logs, the next thing you do is you run
the service. Before you run the service
let's check if that service is already
running or not. In my case, in our case,
it is running, it is active, perfect. If
it is not running in your system, I will
tell you to run it by doing systemctl,
and do start, and it will start the
service. Again, this is how you send the
traffic over to one central logger. It's
the best way to troubleshoot for a
system administrator. And this will make
life a lot easier to have all the logs
under the one roof.
[No audio]