General Information
At work we have a few Linux machines that are used for various things like dns and firewalling. It is a pain to log into each one of these machines when you have to troubleshoot something.
Requirements
- Local root access on the box or be able to su to root.
- A SSH client that supports ANSI colors such as puTTy or SecureCRT (if you aren't on the box).
- Your favorite text editor.
Installation
The syslogd on both FreeBSD and Linux seem to be a little bit limited ( as far as I could figure out ). Let's start by installing syslog-ng.
#
# |
cd /usr/ports/sysutils/syslog-ng
make install clean |
This should create a sample configuration file:
/usr/local/etc/syslog-ng/syslog-ng.conf.sample which I typically copy over to be my real config.
#
# |
cd /usr/local/etc/syslog-ng/
cp syslog-ng.conf.sample syslog-ng.conf |
Tell the startup scripts that it is okay to start syslog-ng by adding
syslogd_enable=”NO”
syslog_ng_enable=”YES”
|
to /etc/rc.conf
This will also stop the default syslogd from starting up.
The sample configuration will configure syslog-ng to act just like the old syslogd. All the file locations will be the same in
/var/log.
syslog-ng basically has four types of statements (maybe more)
- a source(where the logs are coming from)
- a destination(where to send the log entry to - they can even be sent to another program!)
- a filter(usually used to filter the syslog facility)
- the actual log statment(connects the source / filter / destination together)
an example:
source net { udp(); }; # incoming logs from udp port 514
destination messages { file(”/var/log/messages”); }; # Duh, /var/log/messages
filter f_notice { level(notice..emerg); }; # What to allow through
log { source(net); filter(f_notice); destination(messages); }; # Send notices from udp 514 to /var/log/messages
|
In my configuration I have added a destination for all the remote hosts that report to my loghost.
destination remote {
file(”/var/log/remote/$YEAR/$MONTH/$DAY/$HOST.log”
owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes));
};
|
This will create a directory and file like
/var/log/remote/2006/09/20/hostname.log with all their syslog messages in it.
You can see my entire config here.
On the remote machines I simply add
*.* @xxx.xxx.xxx.xxx to
/etc/syslog.conf. This will send everything over to the loghost machine.
Now it is time to install splunk, but before you do that there is one more port to install.
#
# |
cd /usr/ports/misc/compat5x
make install clean |
The splunk install (splunk-2.0.15-freebsd-installer.bin) wouldn’t work without it.
Now download the FreeBSD splunk installer, make it executable, and run. It will ask you a bunch of questions, too many to explain here. You can find out more information on
http://www.splunk.com.
Finally open up the firewall for port 8000, which splunk listens on, and point your browser to loghost:8000.
Good luck
Author: coolest
shonga_kerz at hotmail dot com
