setup log center

28 May 2014

In *inux System, there are some log tools, for example: syslog, rsyslog, syslog-ng, etc..

In our program we can record log to syslog, for example in php:

$priority = LOG_NOTICE;
$ident = 'srain';

$message = 'some messages@' . date('Y-m-d H:i:s');
openlog($ident, LOG_PID, LOG_LOCAL6);
syslog($priority, $message);

When we have more than one webserver which will record log, we need a log center to keep all of the log.


  • syslog

    *.local6  # the port is 514 and using the UDP protocal.
  • rsyslog

    *.local6    @@    # tcp
    *.local6    @     # udp
  • syslog-ng

    description d_loghost { udp("" port(601)};
    log { source(s_sys); description(d_loghost)};


  • rsyslog

    # for udp reception
    $ModLoad imudp
    $UDPServerRun 601
    # for tcp reception
    $ModLoad imtcp
    $InputTCPServerRun 514
  • syslog-ng

    destination df_wrt0 {
        # 不同的 ident 不同的文件
                template("$FULLDATE $SOURCEIP-$HOST[$PID]: $MSG\n")
    source s_net {
        udp(ip( port(601));
        tcp(ip( port(514));
    log { source(s_net); destination(df_wrt0);};


I prefer syslog/rsyslog + syslog-ng. It will be more stable and easy to config.

There were more than 2000 clients to send log to a log center.

Follow Me on GitHub

comments powered by Disqus