目的:
搭建记录CISCO 日志事件的LINUX服务器.
2.cisco交换机地址:10.0.0.71
Linux地址:192.168.80.63
3.试验步骤主要分两大块
1)交换机
首先设置交换机能够发出日志
开启:
(config)#logging on (开启日志)
(config)# logging facility local4 (local4设备号,这要和LINUX那对应)
(config)#logging 192.168.80.63
(config)#logging trap
注意:logging trap level 指定日志消息的级别
logging facility命令更改设备号,并Show logging
2)LINUX
2.1 设置/etc/syslog.conf 配置文件文件(此文件是设置cisco发过来的文件到那个文件)
[root@localhost log]# vi /etc/syslog.conf
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
local4.* /var/log/80.log
(*表示所有消息) (这里local4就是和cisco设置的local4对应,并且它把cisco发过来的日志放到var/log/80.log)
可以用man syslog 共有8种消息等级.
#define KERN_EMERG "<0>" /* system is unusable */
#define KERN_ALERT "<1>" /* action must be taken immediately */
#define KERN_CRIT "<2>" /* critical conditions */
#define KERN_ERR "<3>" /* error conditions */
#define KERN_WARNING "<4>" /* warning conditions */
#define KERN_NOTICE "<5>" /* normal but significant condition */
#define KERN_INFO "<6>" /* informational */
#define KERN_DEBUG "<7>" /* debug-level messages */
alert －需要立即采取的动作
crit －临界状态
err －错误状态。等同error
warning －预警信息，等同warn
notice －正常但是要注意
info －正常消息
debug －调试
none －一般的信息
crit －临界状态
err －错误状态。等同error
warning －预警信息，等同warn
notice －正常但是要注意
info －正常消息
debug －调试
none －一般的信息
2.2修改配置文件/etc/sysconfig/syslog
改这里是因为需要linux去读取来的消息
# Options to syslogd
# -m 0 disables 'MARK' messages.
# -r enables logging from remote machines
# -x disables DNS lookups on messages recieved with –r (不用DNS解析)
# See syslogd(8) for more details
SYSLOGD_OPTIONS=" -m 0" 修改为 SYSLOGD_OPTIONS="-r -x -m 0"
# Options to klogd# -2 prints all kernel oops messages twice; once for klogd to decode, and
# once for processing with 'ksymoops'
# -x disables all klogd processing of oops messages entirely
# See klogd(8) for more details
KLOGD_OPTIONS="-x"
#
SYSLOG_UMASK=077
# set this to a umask value to use for all log files as in umask(1).
# By default, all permissions are removed for "group" and "other".
2.3修改文件syslog 之后
重启syslog服务
Service syslog restart
2.4 查看syslogd进程
ps –ef |grep syslogd |grep –v “grep syslogd”
root 30307 1 0 13:59 ? 00:00:00 syslogd -r -x -m ###有-r 就表示成功
2.5 设置LINUX 允许cisco数据包进来.
[root@localhost log]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere 192.168.80.63 udp dpt:syslog
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
命令是: iptables –A INPUT –p udp –d 192.168.80.63 –dport 514 –j ACCEPT
2.6 查看日志服务器监听的udp端口：514
netstat -untl |grep 514
udp 0 0 0.0.0.0:514 0.0.0.0:* ###514 已经起来
这样,查看80.log是否有记录
[root@localhost log]# cat /var/log/80.log
Jan 14 21:36:06 10.0.0.71 949: 001021: *Mar 14 00:47:29: %SYS-5-CONFIG_I: Configured from console by abc on vty1 (192.168.2.1)
Jan 14 22:51:04 10.0.0.71 950: 001022: *Mar 14 02:01:32: %LINK-3-UPDOWN: Interface FastEthernet0/7, changed state to up
Jan 14 22:51:05 10.0.0.71 951: 001023: *Mar 14 02:01:33: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/7, changed state to up(完)
