/etc/rsyslog.d/50-default.conf 파일을 수정하거나 만들고 파일 끝에 다음 줄을 추가합니다.
local6.* @@FORWARDER_IP:PORT
FORWARDER_IP 및 PORT를 전달자의 IP 주소 및 포트로 바꿉니다. 첫 번째 열은 rsyslog를 통해 /var/log에서 전송되는 로그를 나타냅니다. 두 번째 열의 @@은 TCP를 사용하여 메시지를 보내는 것을 나타냅니다. UDP를 사용하려면 @을 하나 사용합니다.
syslog에 대한 로컬 로깅을 사용 중지하려면 로컬 syslog에 로깅되는 항목을 구성하는 줄에 local6.none을 추가하여 rsyslog를 구성합니다. 파일은 각 OS마다 다릅니다. Debian의 경우 파일이 /etc/rsyslog.conf이고 Ubuntu의 경우 파일이 /etc/rsyslog.d/50-default.conf입니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["Collect Linux auditd and Unix system logs \nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nThis document describes how to collect audit daemon (auditd) and Unix system logs,\nand use the Google Security Operations forwarder to ingest logs to Google SecOps.\n\nThe procedures in this document have been tested on Debian 11.7 and Ubuntu 22.04 LTS (Jammy Jellyfish).\n\nCollect logs from auditd and syslog\n\nYou can configure the Linux hosts to send auditd logs to a Google SecOps\nforwarder by using rsyslog.\n\n1. Deploy the audit daemon and the audit dispatching framework by running the following command.\n If you have already deployed the daemon and framework, you can skip this step.\n\n apt-get install auditd audispd-plugins\n\n2. To enable logging of all commands, which include the user and root, add the following\n lines to `/etc/audit/rules.d/audit.rules`:\n\n -a exit,always -F arch=b64 -S execve\n -a exit,always -F arch=b32 -S execve\n\n | **Note:** If you have enabled Google SecOps [Linux Threats curated detections](/chronicle/docs/detection/linux-threats-category), ensure that you're using the appropriate auditd configuration.\n3. Restart auditd by running the following command:\n\n service auditd restart\n\nConfigure Google SecOps forwarder for auditd\n\nOn the Google SecOps forwarder, specify the following data type: \n\n - syslog:\n common:\n enabled: true\n data_type: AUDITD\n batch_n_seconds:\n batch_n_bytes:\n tcp_address:\n connection_timeout_sec:\n\nFor more information, see [Install and configure the Google SecOps forwarder on Linux](/chronicle/docs/install/forwarder-linux).\n\nConfigure syslog\n\n1. Verify that the parameters in the `/etc/audisp/plugins.d/syslog.conf` file match the following values:\n\n active = yes\n direction = out\n path = /sbin/audisp-syslog\n type = always\n args = LOG_LOCAL6\n format = string\n\n2. Modify or create the `/etc/rsyslog.d/50-default.conf` file and add the following line at the end of the file:\n\n local6.* @@\u003cvar translate=\"no\"\u003eFORWARDER_IP\u003c/var\u003e:\u003cvar translate=\"no\"\u003ePORT\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eFORWARDER_IP\u003c/var\u003e and \u003cvar translate=\"no\"\u003ePORT\u003c/var\u003e\n with the IP address and port of your forwarder. The first column indicates which\n logs are sent from `/var/log` over rsyslog. The `@@` in the second column indicates\n that TCP is used to send the message. To use UDP, use one `@`.\n3. To disable local logging to syslog, configure rsyslog by adding `local6.none`\n to the line that configures what is logged to local syslog. The file differs for each\n OS. For Debian the file is `/etc/rsyslog.conf`, and for Ubuntu the file is\n `/etc/rsyslog.d/50-default.conf`:\n\n *.*;local6.none;auth,authpriv.none -/var/log/syslog\n\n4. Restart the following services:\n\n ```\n service auditd restart\n service rsyslog restart\n ```\n\n \u003cbr /\u003e\n\nCollect Unix systems logs\n\n1. Create or modify the `/etc/rsyslog.d/50-default.conf` file and add the following line at the end of the file:\n\n *.* @@\u003cvar translate=\"no\"\u003eFORWARDER_IP\u003c/var\u003e:\u003cvar translate=\"no\"\u003ePORT\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eFORWARDER_IP\u003c/var\u003e and \u003cvar translate=\"no\"\u003ePORT\u003c/var\u003e with the IP address of your forwarder.\n The first column indicates which logs are sent from `/var/log` over rsyslog. The `@@`\n in the second column indicates that TCP is used to send the message. To use UDP, use one `@`.\n2. Run the following command to restart the daemon and load the new config:\n\n ```\n sudo service rsyslog restart\n ```\n\nConfigure Google SecOps forwarder for Unix logs\n\nOn the Google SecOps forwarder, specify the following data type: \n\n - syslog:\n common:\n enabled: true\n data_type: NIX_SYSTEM\n batch_n_seconds:\n batch_n_bytes:\n tcp_address:\n connection_timeout_sec:\n\nFor more information, see [Install and configure the Google SecOps forwarder on Linux](/chronicle/docs/install/forwarder-linux).\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
