Syslog Setup
The properties relevant for syslog are stored in the file
/etc/rsyslog.conf
Please note:
In a default installation of FOXMAN-UN the configuration file
$/etc/rsyslog.conf
is already provided with a general (i.e., not FOXMAN-UN related) syslog setup definition.
$/etc/rsyslog.conf
is already provided with a general (i.e., not FOXMAN-UN related) syslog setup definition.
To forward to a syslog server the nem-system-event and nem-security-event,
Proceed as follows:
1. Log in to FOXMAN-UN as root or prepend sudo to execute the following commands.
2. Open the following file with a text editor:
/etc/rsyslog.conf
3. In this file add the following lines:
#rules to forward FOXMAN-UN system&security events to syslog server
module(load="imfile")
input(type="imfile" File="/var/log/nem/log/nem-system-event.log" Tag="system" Severity="info" Facility="user" ruleset="remote")
input(type="imfile" File="/var/log/nem/log/nem-security-event.log" Tag="security" Severity="info" Facility="user" ruleset="remote")
ruleset(name="remote"){
action(type="omfwd" target="xxx.xxx.xxx.xxx" port="514" protocol="udp")
}
In the text above, replace xxx.xxx.xxx.xxx with the syslog server IP address
4. Save the file.
5. Restart the rsyslog via
systemctl restartrsyslog.service
Result: Forwarding of FOXMAN-UN syslog messages is enabled.