利用LINUX 系統日誌功能來充當LOG SERVER，/etc/syslog.conf是配置文件，裏面定義了一些服務與日誌路徑， SSH下用vi /etc/sysconfig/syslog，打開看到內容如下：
# Options to syslogd
# -m 0 disables 'MARK' messages.
# -r enables logging from remote machines
# -x disables DNS lookups on messages recieved with -r
# See syslogd(8) for more details
SYSLOGD_OPTIONS="-m 0"
# Options to klogd
# -2 prints all kernel oops messages twice; once for klogd to decode, and
# once for processing with 'ksymoops'
# -x disables all klogd processing of oops messages entirely
# See klogd(8) for more details
KLOGD_OPTIONS="-x"
#
SYSLOG_UMASK=077
# set this to a umask value to use for all log files as in umask(1).
# By default, all permissions are removed for "group" and "other".
# -m 0 disables 'MARK' messages.
# -r enables logging from remote machines
# -x disables DNS lookups on messages recieved with -r
# See syslogd(8) for more details
SYSLOGD_OPTIONS="-m 0"
# Options to klogd
# -2 prints all kernel oops messages twice; once for klogd to decode, and
# once for processing with 'ksymoops'
# -x disables all klogd processing of oops messages entirely
# See klogd(8) for more details
KLOGD_OPTIONS="-x"
#
SYSLOG_UMASK=077
# set this to a umask value to use for all log files as in umask(1).
# By default, all permissions are removed for "group" and "other".
SYSLOG_OPTIONS的參數默認是"-m 0"這樣應該是隻記錄本機的日誌，上面有一個參數-r(remote),添加成“-rm 0"之後爲：
SYSLOGD_OPTIONS="-rm 0"
這是一個服務，你可以用/etc/init.d/syslog restart 重啓，
你就可以把遠程的網絡設備什麼的日誌放到這個機器上了，只不過它放在/VAR/LOG/MESSAGES文件中，要想自定義其路徑及文件需要修改/etc/syslog.conf文件，在文件尾添加
local0.* /var/log/router.log
local0-local7 爲用戶可以自己定義使用 的、
我用思科的
NAV10-WF-ADVSEC的日誌記錄到遠程機器的功能測試
一秒之後 CAT /VAR/LOG/MESSAGES文件。
將會看到一些有關思科的NAV的日誌記錄。
Nov 17 13:07:01 192.168.1.1 Router kernel: KERN_INFO [IPS] (eth0)(4094) Hit rule-name: P2P QQLive UDP attempt, source ip: 119.147.18.173 action: drop
Nov 17 13:07:40 192.168.1.1 last message repeated 3 times
Nov 17 13:08:45 192.168.1.1 last message repeated 6 times
Nov 17 13:09:04 192.168.1.1 last message repeated 2 times
Nov 17 13:09:11 192.168.1.1 Router kernel: KERN_INFO [IPS] (eth0)(4094) Hit rule-name: Possible DoS HGOD SynKiller Flooding, source ip: 61.191.191.151 action: drop, block/reset
Nov 17 13:09:13 192.168.1.1 Router kernel: KERN_INFO [IPS] (eth0)(4094) Hit rule-name: P2P QQLive UDP attempt, source ip: 119.147.18.173 action: drop
Nov 17 13:09:52 192.168.1.1 last message repeated 4 times
Nov 17 13:11:00 192.168.1.1 last message repeated 7 times
Nov 17 13:12:08 192.168.1.1 last message repeated 7 times
Nov 17 13:07:40 192.168.1.1 last message repeated 3 times
Nov 17 13:08:45 192.168.1.1 last message repeated 6 times
Nov 17 13:09:04 192.168.1.1 last message repeated 2 times
Nov 17 13:09:11 192.168.1.1 Router kernel: KERN_INFO [IPS] (eth0)(4094) Hit rule-name: Possible DoS HGOD SynKiller Flooding, source ip: 61.191.191.151 action: drop, block/reset
Nov 17 13:09:13 192.168.1.1 Router kernel: KERN_INFO [IPS] (eth0)(4094) Hit rule-name: P2P QQLive UDP attempt, source ip: 119.147.18.173 action: drop
Nov 17 13:09:52 192.168.1.1 last message repeated 4 times
Nov 17 13:11:00 192.168.1.1 last message repeated 7 times
Nov 17 13:12:08 192.168.1.1 last message repeated 7 times
syslog 的遠程日誌要用到UDP 514端口號，如果你用IPTABLES ，那就打開這個端口
iptables -A INPUT -p udp -i 'yourethif ' -s '設備的IP' -d 'linux主機' --sport 514 -j ACCEPT
比較簡單，別扔石頭。。。。