What is this page about
At out site, all the linux boxes use remote logging so we can collate the logs on a central server. This works well for a small number of machines but now we want to separate into groups of machines (servers, staff & students). Unfortunately the syslogd from sysklogd reads a port number only from /etc/services and we can't control the interface which it binds to.
One solution would be to modify the code to solve one or both of these issues but I was looking for a way which did not require source modification. The solution was to use a chroot environment.
Setting up the chroot
First I will present the commands required for setting this up on Red Hat Enterprise Linux 2.1, then I will list some techniques for working out any steps for yourself. In the statement below, the # indicates a root shell prompt which you should not type in.
# mkdir -p /var/log/virtual/student
The daemon can then be started with this command
You can control the port that syslogd will use by
editing etc/services and modifying the syslog port number. You
should probably use debug mode to make sure that things are working.
To do that, start stunnel with the -d parameter
If you get errors about missing libraries or file
not found errors, your syslogd binary might be linked against different
libraries than mine (this is quite possible if you are not running
RHEL21). If so you can get a
list of libraries by using the ldd command
For each library listed, copy it into the lib directory. Don't worry about using subdirectories like i686 unless you are really anal and want to set up the symlinks.
Because parts of libc are dynamically loaded at run time, you may require libraries which are not listed by ldd. The easy way to find out what you need it to use strace. Install strace in your chroot and then run syslogd
# mkdir -p usr/bin
Library loads will be shown like this
Once you have everything set up, write an init script to start everything up the way you want it and your server side is done.
The client side is quite simple, just edit the syslog port number in /etc/services. You can do this with a simple (?) perl command. This command will change the port number to 1234.
# /usr/bin/perl -pi -e "s|^syslog[[:space:]].*/udp$|syslog 1234/udp|" /etc/services
For the truly lazy (download)
Other things to do
You probably want to rotate the virtual logs too. In /etc/logrotate.d make a copy of syslog called syslog_<virtual name> for each of your virtual hosts. Edit the file and prepend the /var/log/<virtual name> to each of the log file names and the .pid file name
If you run psionic logcheck then you can easily edit logcheck.sh to use a virtual directory. Again if you are lazy you can download my custom version