远程系统日志服务器未收到日志

Question

我正在尝试将日志（/var/log/secure 和 /var/log/messages）从 Linux 服务器 (rsyslog) 集中到 Solaris 服务器 (syslog)。

我的rsyslog.conf 文件：

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
*.info;mail.none;authpriv.none;cron.none @logserver:514

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure
authpriv.*      @logserver:514
# Log all the mail messages in one place.
mail.*                                                  /var/log/maillog

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

在 Solaris 上，我将服务器配置为接受日志：

svccfg -s system-log setprop config/log_from_remote = true

我重新启动了 syslog 和 rsyslog，但它不起作用。

Answer 1

UDP 可能是防火墙。使用 Solaris snoop 命令查看是否有数据进来。