我已经设置了一个rsyslog服务器(基于CentOS 6),可以与一些远程主机一起使用.
但是,当我添加Cisco ASA防火墙时,它会记录其消息!
但是,当我添加Cisco ASA防火墙时,它会记录其消息!
rsyslog.conf如下:@H_502_4@
# rsyslog v5 configuration file # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html # If you experience problems,see http://www.rsyslog.com/doc/troubleshoot.html ### MODULES #### $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imklog # provides kernel logging support (prevIoUsly done by rklogd) # Provides UDP syslog reception $ModLoad imudp $UDPServerRun 514 #### GLOBAL DIRECTIVES #### # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # Include all config files in /etc/rsyslog.d/ $IncludeConfig /etc/rsyslog.d/*.conf # Log all kernel messages to the console. # Logging much else clutters up the screen. #kern.* /dev/console # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* -/var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * # Save news errors of level crit and higher in a special file. uucp,news.crit /var/log/spooler # Save boot messages also to boot.log local7.* /var/log/boot.log
##RSYSLOG configuration file for Remote Logs $FileCreateMode 0640 $template PerHostLog,"/var/log/remote/%HOSTNAME%.log" if ($fromhost-ip startswith '10.1.5' or $fromhost-ip startswith '10.2.8') then -?PerHostLog & ~
这些规则有什么问题吗?
TCPdump显示来自10.2.8.1主机的消息到达服务器,但syslog选择忽略它们.为什么??@H_502_4@