h3c交换机推送日志至syslog服务器

华三官网文档并不完全正确，并且很多系统已经用rsyslog而不是syslog。在这里记录下配置

1、交换机侧配置

[H3C]info-center enable
# ip替换成日志服务器的ip 使用local5作为日志主机记录工具。
[H3C]info-center loghost 172.20.161.249 facility local5 
[H3C]info-center source default console level ?alert          Action must be taken immediately (severity=1)critical       Critical conditions (severity=2)debugging      Debug-level messages (severity=7)emergency      System is unusable (severity=0)error          Error conditions (severity=3)informational  Informational messages (severity=6)notification   Normal but significant conditions (severity=5)warning        Warning conditions (severity=4)
选择要推送的级别日志

2、服务器侧配置

a. 检查rsyslog服务

[root@localhost ~]# systemctl status rsyslog
● rsyslog.service - System Logging ServiceLoaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)Active: active (running) since Tue 2024-10-29 20:01:34 PDT; 32min agoMain PID: 24893 (rsyslogd)Memory: 3.9MCGroup: /system.slice/rsyslog.service└─24893 /usr/sbin/rsyslogd -nOct 29 20:01:34 localhost.localdomain systemd[1]: Starting System Logging Service...
Oct 29 20:01:34 localhost.localdomain systemd[1]: Started System Logging Service.

b.在/var/log/路径下为Device创建同名日志文件夹Device，在该文件夹创建文件info.log，用来存储来自Device的日志

mkdir /var/log/Device
touch /var/log/Device/info.log

c. 编辑/etc/rsyslog.conf

# Provides UDP syslog reception

#$ModLoad imudp

#$UDPServerRun 514

# Provides TCP syslog reception

#$ModLoad imtcp

#$InputTCPServerRun 514

标红字段删除前面的# 来接受其他机器日志

文件末尾添加

local5.*    /var/log/Device/info.log

表示接受local5的所有日志级别的信息

3、实现效果

交换机执行命令

服务器tail -f查看日志变化