[Lubuntu] Simple configuration for remote logging with rsyslogd

[Phill Whiteside]

Hi John,

I'm a couple of years out from when our last guy asked about LTSP.. Back in
10.04 a teacher in a non 1st world country 'found' lubuntu. Ubuntu via
GNOME was becoming 'too heavy' for his out dated computer lab. He was so
thankful for the ability to actually have the quite ancient blade server be
able to continue to serve his students.

There are times in life when you think "did I make a difference"? Well, all
I will say is via the reverse speak of 'star wars'... *small in number,
change they made*. We answered his questions and got him up and running.

Lubuntu makes a difference, it is a really stripped back system, go add to
it what you need... But, may I make a request? Please write down what you
have done so that others who do not have your technical knowledge, but have
the heart to help have it as a resource to help their class.

Regards,

Phill.

On 3 December 2012 22:36, John Hupp <lubuntu at prpcompany.com> wrote:

>
>  On 11/30/2012 4:47 PM, John Hupp wrote:
>
> On Lubuntu Quantal, it looks like rsyslogd is installed with a certain
> configuration -- probably just for local logging -- but is not set to
> auto-start.
>
> I'm trying to set up remote logs for an LTSP client (to log to the LTSP
> server) for the sake of troubleshooting a client boot problem.  The LTSP
> manual has this sample for syslog-ng's configuration file
> /etc/syslog-ng/syslog-ng.conf:
>
>     source net-udp { udp(); };
>     destination remote { file("/var/log/remote/$FULLHOST"); };
>     log { source(net-udp); destination(remote); };
>
> Does anyone know if the rsyslogd would use the same statements in its
> configuration file?
>
>  I having a working recipe for this (and I was wrong about rsyslog not
> auto-starting -- it is good to go):
>
> To accomplish forwarding of syslog messages by TCP (rather than by UDP or
> RELP):
>
> In /etc/rsyslog.conf for the client machine add this to the end of the
> file:
> *.*   @@<server's IP address>:10514
>
> For an LTSP network, if it is a standard LTSP 5 setup with a chroot
> environment, then just edit the file as above and update the image.
>
> For an LTSP network with an LTSP-PNP setup it is trickier.  For temporary
> troubleshooting you can just modify /etc/rsyslog.conf, update the client
> NBD image, then edit /etc/rsyslog.conf again with the settings required for
> the server.  If you want a permanent forwarding setup that will not be
> overwritten by image updates, then you would probably write a script in
> /usr/share/ltsp/init-ltsp.d that modifies /etc/rsyslog.conf in place
> on-the-fly during bootup (using the stream editor command "sed").  But I
> have not had a successful experience with that yet, so I merely toss that
> out as a lead.
>
> -------------------
>
> In /etc/rsyslog.conf for the server where you want the messages forwarded,
> un-comment these two lines in rsyslog.conf:
> $ModLoad imtcp
> $InputTCPServerRun 10514
>
> This much alone on the server will cause forwarded messages to be received
> on the server and incorporated in the standard log file at
> /var/log/syslog.  But they will be added to the messages that are logged
> for the server itself.  That may do for your purposes since all messages
> are tagged with the host name, but you can also have the messages written
> to another file by adding these lines to rsyslog.conf:
>
> if $fromhost-ip startswith '192.168.1.' then /var/log/ltspclientlog
> & ~
>
> Substitute whatever client IP address applies in your situation.  The
> above command will separately log received messages from any client with IP
> 192.168.1.xxx.  Also substitute whatever log name you would like for my
> choice of "ltspclientlog."
>
> The configuration above will cause the client syslog messages to be logged
> in both /var/log/ltspclientlog and /var/log/syslog.  I don't know why.  The
> "& ~" command is supposed to stop further processing of the message after
> it is written to ltspclientlog.  Perhaps I misunderstood the documentation
> and forwarded messages are *always* written to syslog, and then perhaps
> other files as well.  Or perhaps LTSP has some functionality in it that
> causes forwarded messages to be written to syslog.
>
>
> --
> Lubuntu-users mailing list
> Lubuntu-users at lists.ubuntu.com
> Modify settings or unsubscribe at:
> https://lists.ubuntu.com/mailman/listinfo/lubuntu-users
>
> --
> <https://lists.ubuntu.com/mailman/listinfo/lubuntu-users>
> https://wiki.ubuntu.com/phillw
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/lubuntu-users/attachments/20121204/346d52da/attachment.html>