日志服务器：192.168.6.205
# rsyslog配置 [root@localhost log]# cat /etc/rsyslog.conf | grep -Ev "^#|^$" $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imjournal # provides access to the systemd journal $ModLoad imudp # 开启udp接收 $UDPServerRun 514 # udp端口 $ModLoad imtcp # 开启tcp接收 $InputTCPServerRun 514 # tcp端口 $WorkDirectory /var/lib/rsyslog $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $IncludeConfig /etc/rsyslog.d/*.conf $OmitLocalLogging on $IMJournalStateFile imjournal.state *.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron *.emerg :omusrmsg:* uucp,news.crit /var/log/spooler local7.* /var/log/boot.log local6.* /var/log/usg6000.log # usg设备发送过来的设施代码为local6，将所有日志级别(.*)写到配置的日志路径
# 重启rsyslog [root@localhost log]# systemctl restart rsyslog
# usg配置 [USG6300]info-center enable [USG6300]info-center source default channel 2 log level informational [USG6300]info-center loghost 192.168.6.205 facility local6 port 514 channel 2 language English source-ip 192.168.12.45 Warning: There is security risk as this operation enables a non secure syslog protocol. facility 为对应 rsyslog 中的设施代码，usg中支持0-7 [USG6300]info-center loghost 192.168.6.205 facility ? local0 Logging host facility local1 Logging host facility local2 Logging host facility local3 Logging host facility local4 Logging host facility local5 Logging host facility local6 Logging host facility local7 Logging host facility
# rsyslog配置发送者白名单，允许来源ip $AllowedSender UDP, 192.168.222.10/24, 10.0.0.0/8
# 通过shell命令测试发送日志消息 logger -n 192.168.6.205 -p user.info "aaaaaaaaaaaa"
