Central Longer is this is a server that acts as a server and it receives all the logs from every server,
every client set out there to receive the logging information.
The purpose of this server is to generate logs within its own self, which manages all the logs in the
log directory.
And also, if it is as built to receive all the logs, then it could work as a central logger.
And the reason we call it central log is because it is a central location, just like you see a lot
of a lot of names like Grand Central or Central location.
Anything that is centrally located to receive all incoming traffic, whether it is trains or airplanes
or buses, you will most likely hear the word central along with the name of his actual location.
So in our Linux environment, we have the server called Central Logger and it has a service that runs
within that server.
It's called RSS Log.
And the name of the service or the package is Artosis Log.
It is not does not have a D at the end, but it's just just it's just something that you have to get
used to it.
I don't know why it does not have the some of the service has it, some of them services don't.
But that's OK.
Use, there's something you just have to live in.
A configuration file is located at theses log dotcom file.
This is where you go in and change the parameters if you have to.
And the service to start to stop its exact syntax would be since system ctrl restart our service log
and to enable it at boot time, which means every time you reboot your system, you want this service
to be up and running along with the system.
So you enable a picture, speaks thousand words.
So that's why I have this picture on the right hand side.
If you see in the middle we have the server, which is acting as a central logger.
It receives all the traffic from all other servers.
Those servers could be any any it's not specifically a server could be a modem.
It could be a Windows machine.
It could be a Linux machine.
It could be a printer.
You could have any of those devices configured to send its log traffic to once-Over.
Now, the good question is, why do we need our SAS log server or Central Logger?
Well, ask yourself if you are working in an environment where there are thousand servers and you having
issues with servers every now and then, sometimes three servers, sometimes tense over sometimes 100
servers, are you actually going to go log into every server one by one and check the logs to see which
system is having issue and where actually the problem is happening?
Of course not, right, because it's tedious task, you don't want to waste your time there, you're
a productive person, so you want to make your your life much easier.
You want to make your system more efficient so that when you create the central logger, the less will
go into a machine.
I have a pretty session open and I will go straight into the PUDI session of my machine.
Just make sure I am Groot because you have to be rude to go and modify those files.
The first thing you have to do is check if you have the package installed for our test log.
And to do that, the command is R.P.M. Dash Kuai, which will list every packages install in your system.
And the reason we use grep is because we don't want to list every package that out there.
We just we are just concerned about our Saslaw packet and you run it and you do get that information
that you are looking for, excluding all other packages that you don't really care about at this point.
So you have the package perfect.
You if you did not have that package, you would have to run youm install or Sizzla and it will install
the package as long as you have Internet connection and it goes to sentence S.O.S or any red hair repository.
Now the configuration file is at C o six sis log file sorry.
In my configuration file on my slide I missed R is just a misspelling of exit.
So the file is etsi are logged horcoff and when you go in there you hit enter and anything you see again
that starts with hash, you could ignore it.
Some of the parameters are by default has been commented out if you wanted to have it enabled.
If you want to traffic UDP traffic or any of the traffic coming in, you have to take out this hash
sign in front of it.
So the parameter would be enable.
The one that we are really concerned about is all the way at the end.
Which one is right here?
Starts with hash.
You would have to take it out if you are sending your system.
This is your system.
If you are sending this system logs to another central logger, you will specify the name the hostname
or the IP address of that central logger.
This is the port five and four.
By default, our system of communication takes place on Port five, one for just like any other services,
like DNS talks on Port 53.
And there are many other services like NNTP talks, I believe one twenty three just like that.
Every service has an associated port to it and it will talk only on that port.
So you save it if you wanted to comment that out.
And then once you have it saved, you know you're sending your logs.
The next thing you do is you run the service before you run the service.
Let's check if that service is already running or not.
In my case, in our case, it is running.
It is active, perfect.
It is not running in your system.
I would tell you to run it by doing system CTL and do start and it will start to service again.
This is how you send the traffic over to one central logger.
It's the best way to troubleshoot for a system administrator, and this will make life a lot easier
to have all the logs and under one roof.