日志文件服务器的架构示意图:

一、Windows作为日志服务器及linux作为客户机
1.
dhcp服务器
[root@www ~]# vim /etc/dhcpd.conf

[root@www ~]# service dhcpd restart
关闭 dhcpd: [确定]
启动 dhcpd: [确定]
2.windows xp 作为日志服务器![clip_image002[4] clip_image002[4]](http://5645432.blog.51cto.com/attachment/201208/6/5635432_1344252280Smvi.jpg)
获取的ip地址如下:

安装此软件


其他默认
![clip_image002[6] clip_image002[6]](http://5645432.blog.51cto.com/attachment/201208/6/5635432_134425232348fk.jpg)
3.
Linux系统作为应用服务器
配置如下:
[root@gjp99 ~]# vim /etc/syslog.conf
*.* @192.168.10.34
[root@gjp99 ~]# /etc/init.d/syslog restart //重启syslog
Shutting down kernel logger: [ OK ]
Shutting down system logger: [ OK ]
Starting system logger: [ OK ]
Starting kernel logger: [ OK ]
[root@gjp99 ~]# netstat -lunp | grep syslog //查看其状态
udp 0 0 0.0.0.0:514 0.0.0.0:* 4261/syslogd

二.两台linux系统之间的配置:
客户机端:
[root@www ~]#vim /etc/syslog.conf
*.* @192.168.10.63
[root@www ~]#service syslog restart
用dhcp服务器获取ip地址:
![clip_image002[8] clip_image002[8]](http://5645432.blog.51cto.com/attachment/201208/6/5635432_1344252338FwQw.jpg)
![clip_image004[5] clip_image004[5]](http://5645432.blog.51cto.com/attachment/201208/6/5635432_1344252341x4gO.jpg)

服务器端:
[root@www ~]# vim /etc/sysconfig/syslog
6 SYSLOGD_OPTIONS="-m 0 -r"
[root@www ~]#service syslog restart
[root@www ~]#service dhcpd restart
[root@www ~]# tail -f /var/log/messages //获取ip地址后的日志信息
Aug 6 18:18:26 www dhcpd: DHCPDISCOVER from 00:0c:29:2a:5c:13 via eth0
Aug 6 18:18:27 www dhcpd: DHCPOFFER on 192.168.10.60 to 00:0c:29:2a:5c:13 via eth0
Aug 6 18:18:27 www dhcpd: DHCPREQUEST for 192.168.10.60 (192.168.10.63) from 00:0c:29:2a:5c:13 via eth0
Aug 6 18:18:27 www dhcpd: DHCPACK on 192.168.10.60 to 00:0c:29:2a:5c:13 via eth0
本文转自 gjp0731 51CTO博客,原文链接:http://blog.51cto.com/guojiping/956325