This article shows how to enable the remote rsyslog on our mars400.

Mars400 has a rsyslog service running on each node. Users can redirect Syslog to a log server and save the local storage space for logs. 

Edit the file /etc/rsyslog.d/50-default.conf and change the line

 

*.*;auth,authpriv.none        -/var/log/syslog

to

*.*;auth,authpriv.none        @<remote IP>:<remote udp port>


example

*.*;auth,authpriv.none        @192.168.212.5:514


Where the <remote IP>: <remote udp port> is the remote syslog server IP and port.


  1. Prepare remote rsyslog server with port 514(default) or other special port
  2. Do following command at our mars400
    cp 50-default.conf 50-default.conf.ori
# diff changed
# diff -Nuar 50-default.conf.ori 50-default.conf
--- 50-default.conf.ori 2022-12-26 16:59:20.800239834 +0800
+++ 50-default.conf     2022-12-26 17:02:12.096009674 +0800
@@ -6,7 +6,8 @@
 # First some standard log files.  Log by facility.
 #
 auth,authpriv.*                        /var/log/auth.log
-*.*;auth,authpriv.none         -/var/log/syslog
+# *.*;auth,authpriv.none       @<remote ip>:<remote udp port>
+*.*;auth,authpriv.none         @192.168.212.5:12514
 #cron.*                                /var/log/cron.log
 #daemon.*                      -/var/log/daemon.log
 kern.*                         -/var/log/kern.log


  3. Restart Rsyslog service