ubuntuをsyslogとsnmptrapのサーバにする設定

syslog-ngでsyslogとsnmptrapを記録するように設定し、logrotateの設定を行いました。

≪パッケージインストール≫
root@ubuntu:~# sudo aptitude install syslog-ng snmpd
..snip..
root@ubuntu:~#
root@ubuntu:~# sudo mkdir /var/log/syslog-net


≪syslog-ngの設定≫
・受信したすべてのSyslogをソースアドレス毎に別ファイルで保存する。ついでにsnmptrap用の設定も行う。

root@ubuntu:~# cat /etc/syslog-ng/syslog-ng.conf
..snip..
source net { udp( ip(0.0.0.0) port(514) ); tcp( ip(0.0.0.0) port(514) ); };
destination d_net { file("/var/log/syslog-net/$HOST.log"); };
destination df_snmptrap { file("/var/log/snmptrapd.log"); };
filter f_snmptrap { facility(local6); };
log { source(net); destination(d_net); };
log { source(s_all); filter(f_snmptrap); destination(df_snmptrap); };
root@ubuntu:~#
root@ubuntu:~# sudo mkdir /var/log/syslog-net
root@ubuntu:~#


≪snmptrapdの設定≫
・受信したすべてのtrapをsyslogに送る。

root@ubuntu:~# cat /etc/default/snmpd
..snip..
TRAPDRUN=yes

# snmptrapd options (use syslog).
#TRAPDOPTS='-Lsd -p /var/run/snmptrapd.pid'
TRAPDOPTS='-Ls 6 -p /var/run/snmptrapd.pid'

root@ubuntu:~#
root@ubuntu:~# cat /etc/snmp/snmptrapd.conf
disableAuthorization yes
root@ubuntu:~#

≪logrotateの設定≫
root@ubuntu:~# cat /etc/logrotate.d/labo
/var/log/syslog-net/*.log {
monthly
rotate 36
compress
notifempty
missingok
olddir /var/log/syslog-net/old
}

/var/log/snmptrapd.log {
monthly
rotate 12
compress
notifempty
missingok
postrotate
/etc/init.d/syslog-ng reload >/dev/null
endscript
}
root@ubuntu:~#
root@ubuntu:~# sudo mkdir /var/log/syslog-net/old
root@ubuntu:~#


≪正常に動作するかを確認≫
root@ubuntu:~# logrotate -d /etc/logrotate.d/labo
reading config file /etc/logrotate.d/labo
reading config info for /var/log/syslog-net/*.log
olddir is now /var/log/syslog-net/old
reading config info for /var/log/snmptrapd.log

Handling 2 logs

rotating pattern: /var/log/syslog-net/*.log monthly (36 rotations)
olddir is /var/log/syslog-net/old, empty log files are not rotated, old logs are removed
considering log /var/log/syslog-net/192.168.1.1.log
log does not need rotating
considering log /var/log/syslog-net/192.168.1.2.log
log does not need rotating
considering log /var/log/syslog-net/192.168.1.3.log
log does not need rotating
considering log /var/log/syslog-net/192.168.1.4.log
log does not need rotating
considering log /var/log/syslog-net/192.168.1.5.log
log does not need rotating
considering log /var/log/syslog-net/192.168.1.6.log
log does not need rotating
considering log /var/log/syslog-net/192.168.1.7.log
log does not need rotating
considering log /var/log/syslog-net/192.168.1.8.log
log does not need rotating
considering log /var/log/syslog-net/192.168.1.9.log
log does not need rotating

rotating pattern: /var/log/snmptrapd.log monthly (12 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/snmptrapd.log
log does not need rotating
root@ubuntu:~#