YAMAHA RTX1210のログをCentOS8のrsyslogの機能を使って蓄積していく。rsyslogの機能は豊富です。簡単にログが取れるか程度の記載となっています。
CentOS側
rsyslog.confの編集＝コメント外しmoduleとinput行
|
1 2 3 4 5 6 7 8 9 10 |
vi /etc/rsyslog.conf # Provides UDP syslog reception # for parameters see http://www.rsyslog.com/doc/imudp.html module(load="imudp") # needs to be done just once input(type="imudp" port="514") # Provides TCP syslog reception # for parameters see http://www.rsyslog.com/doc/imtcp.html module(load="imtcp") # needs to be done just once input(type="imtcp" port="514") |
rsyslog.confの編集 ホストIPアドレス月毎のログファイル
IPアドレスのフォルダ⇒IPアドレスYYYYMM.log形式で保存
|
1 2 |
$template logFileName,"/var/log/syslog/%fromhost-ip%/%fromhost-ip%_%$year%%$month%.log" *.* -?logFileName |
rsyslogサーバの再起動
# systemctl restart rsyslog
RTX1210側
|
1 2 3 4 |
syslog host rsyslog サーバのIPアドレス syslog notice off syslog debug off save |
ログが生成されているか
# pwd
/var/log/syslog/192.168.1.100
# ls
192.168.1.100_202106.log
外部からRTX1210に対してL2TP IPsec VPNの接続～切断をみる
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
接続 Jun 29 13:58:18 _gateway [IKE] respond ISAKMP phase to ***.***.***.*** Jun 29 13:58:18 _gateway [IKE] respond IPsec phase to ***.***.***.*** Jun 29 13:58:18 IP Tunnel[22] Up Jun 29 13:58:18 _gateway [L2TP] TUNNEL[22] connected from ***.***.***.*** Jun 29 13:58:18 _gateway [L2TP] TUNNEL[22] tunnel 60781 established Jun 29 13:58:18 _gateway [L2TP] TUNNEL[22] session 49871 established Jun 29 13:58:18 _gateway PP[ANONYMOUS04] Call detected from user 'VPNユーザアカウント' Jun 29 13:58:18 _gateway PP[ANONYMOUS04] PPP/IPCP up (Local: 192.168.1.100, Remote: 192.168.1.104) 切断 Jun 29 14:00:16 _gateway [L2TP] TUNNEL[22] disconnect session 49871 complete Jun 29 14:00:16 _gateway [L2TP] TUNNEL[22] disconnecting tunnel 60781 Jun 29 14:00:16 _gateway [L2TP] TUNNEL[22] disconnect tunnel 60781 complete Jun 29 14:00:16 IP Tunnel[22] Down Jun 29 14:00:16 _gateway [IKE] initiat |
おまけ
|
1 2 3 4 5 6 7 8 9 10 11 |
cat /var/log/syslog/192.168.1.100/192.168.1.100_202107.log \ |grep -E 'Call detected|session'\ | sed -e 's/_gateway//g' \ | sed -e 's/PP\[ANONYMOUS[0-9][0-9]\] Call detected from user/VPN_USR/g' \ | sed -e 's/ \[L2TP\] TUNNEL//g' \ | sed -e 's/disconnect session/DISCONN/g' \ | sed -e 's/session/CONNECT/g' \ | sed -e 's/established/00/g' \ | sed -e 's/complete/02/' \ | sed -e 's/ / /g' \ | sed -e "s/'\$/' 01/g" |
コメント