Instructor: Central Logger is a server that acts
as a server and it receives all the logs
from every server or every client that are out
there to receive the logging information.
The purpose of this server is to generate logs
within its own self
which manages all the logs in wire log directory.
And also if it is built to receive all the logs
then it could work as a central logger.
And the reason we call it central logger is
because it is a central location.
Just like you'll see a lot of
names like Grand Central
or central location, anything that is centrally
located to receive all the incoming traffic
whether it is trains or airplanes or buses
you will most likely hear the word central
along with the name office, actual location.
So in our Linux environment we have the server
called Central Logger
and it has the service that runs within that server.
It's called Rsyslog.
And the name of the service or the package is Rsyslog
It does not have a D at the end, but it's just
something that you have to get used to it.
I don't know why it does not have D.
Some of the service has it, some of them services don't.
But that's okay.
There's something you just have to live with.
Configuration file is located in etc/rsyslog.conf file.
This is where you go in
and change the parameters if you have to.
And the service to start or stop
it's exact syntax would be syn system CTL
restart Rsyslog and to enable it at boot time
which means every time you reboot your system
you want this service to be up
and running along with the system boot.
So you enable it.
Picture speaks thousand words.
So that's why I have this picture
on the right hand side, if you see in the middle
we have the server, which is acting as a central logger.
It receives all the traffic from all other servers.
Those servers could be any, any, it's not specifically
a server.
It could be a modem, it could be a Windows machine
it could be a Linux machine, it could be a printer.
You could have any of those devices configured
to send its log traffic to one server.
Now the good question is why do we need Rsyslog server
or Central Logger?
Well ask yourself if you are working in an environment where
there are thousand servers and you're having issues
with servers every now and then, sometime three servers
sometimes ten servers, sometimes hundred servers
are you actually gonna go log into every server one by one
and check the logs to see which system is having issue
and where actually the problem is happening?
Of course not, right?
Because it's tedious task.
You don't want to waste your time there.
You're a productive person.
So you want to make your life much easier.
You wanna make your system more efficient.
So that's when you create the central logger.
So let's go into a Linux machine.
I have a putty session open
and I'll go straight into the putty session of my machine.
I'll just make sure I am root
because you have to be root to go in and modify those files.
The first thing you have to do is check
if you have the package installed for Rsyslog.
And to do that, the command is RPM-QA, which
will list every package that's installed in your system.
And the reason we use grep is because we don't
want to list every package that's out there.
We just, we are just concerned
about Rsyslog package and you run it
and you do get that information that you're looking for
excluding all other packages that you don't really care
about at this point.
So you have the package perfect.
If you did not have that package
you would have to run Yum install Rsyslog
and it will install the package as
long as you have internet connection and it goes
to CentOS or any red hat repository.
Now the configuration file is etc/rsyslog.conf file.
Sorry, in my configuration file on my slide, I missed R
it's just a misspelling, I'll fix it.
So the, the file is etc/rsyslog.conf
and when you go in there, you hit Enter.
And anything you see again that starts with hash
you could ignore it.
Some of the parameters are
by default has been commented out.
If you want to have it enabled
if you want the traffic UDP traffic
or any of the traffic coming in
you have to take out this hash sign in front of it.
So the parameter will be enable.
The one that we are really concerned about is all the way
at the end, which one is right here starts with hash.
You would have to take it out.
If you are sending your system, this is your system.
If you are sending this system logs
to another central logger, you will specify the name
the host name, or the IP address of that central logger.
This is the Port 514.
By default, Rsyslog communication takes place
on port 514.
Just like any other services, like DNS talks on Port 53
and there are many other services like NTP talks
I believe 123, just like that
every service has an associated port
to it and it will talk only on that port.
So you save it if you want to comment that out.
And then once you have it saved
you know you're sending your logs.
The next thing you do is you run the service.
Before you run the service.
Let's check if that service is already running or not.
In my case, in our case, it is running, it is active.
Perfect. If it is not running in your system
I will tell you to run it by doing system CTL
and do start and it will start the service.
Again, this is how you send the traffic over
to one Central Logger.
It's the best way to troubleshoot for a system administrator
and this will make life a lot easier to have all the logs
in under one roof.