通过rsyslong收集网络设备日志

安装日志收集工具
yum install -y rsyslog
目前公司网络设备分为三类，分别为h3c、huawei、cisco三种
修改配置文件

vim rsyslog.conf

$ModLoad imudp
$UDPServerRun 514

$ModLoad imtcp
$InputTCPServerRun 514

$ModLoad imklog
$WorkDirectory /var/lib/rsyslog
#$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
*.info;mail.none;authpriv.none;cron.none;local1.none;local2.none;local3.none;local4.none;local5.none;local6.none               /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log
#收集网络日志
$template h3c,"/log_data/h3c/%FROMHOST-IP%.log"
local6.* ?h3c
$template huawei,"/log_data/huawei/%FROMHOST-IP%.log"
local5.* ?huawei
$template cisco,"/log_data/cisco/%FROMHOST-IP%.log"
local4.* ?cisco

创建存放日志路径

mkdir  /log_data/huawei/ -p
mkdir  /log_data/h3c/  -p
mkdir  /log_data/cisco/  -p
启动服务
systemctl start rsyslogd
systemctl enable rsyslogd

在网络设备上配置日志输入

“ 网络设备配置
Huawei：info-center loghost source Vlanif99
info-center loghost 10.10.0.184 facility local5

H3C:
info-center loghost source Vlan-interface99
info-center loghost 10.10.0.184 facility local6

CISCO:
(config)#logging on
(config)#logging 10.10.0.184 
(config)#logging facility local4
(config)#logging source-interface e0

Ruijie：logging buffered warnings
logging source interface VLAN 99
logging facility local6
logging server 10.10.0.184


注意：10.10.0.184为rsyslog服务器的IP ”

注意：需要开放日志收集服务器的 514端口访问权限。
当有日志输出后，可在定义的目录生成日志，用于后期对接elk

image.png