More than 3 years have passed since last update.

rsyslogでsecureログの分離

AWS
rsyslog
NLB

Posted at 2020-06-11

#NLB→OSのヘルチェックでport22利用する場合のヘルスチェックログ退避

#/etc/rsyslog.conf 例

if ($programname == 'sshd') and ($msg contains 'from 192.168.1.xxx' or $msg contains 'from 172.16.xxx.xxx') then /var/log/nlbhc.log
&~
authpriv.*                                              /var/log/secure

#/var/log/nlbhc.log　のログローテ
/etc/logrotate.d/syslog で設定

You get articles that match your needs
You can efficiently read back useful information
You can use dark theme

What you can do with signing up