环境：客户端和服务端都需要安装rsyslog服务
rsyslog server端
cd /etc/rsyslog.d/ cat server.conf $ModLoad imtcp $InputTCPServerRun 514 vim /etc/rsyslog.conf local4.* /var/log/history.log
rsyslog client端
cat /etc/rsyslog.d/client.conf local4.* @@server端ip:514
cat /etc/profile.d/client.sh
export PROMPT_COMMAND=‘{ msg=$(history 1 | { read x y; echo $y; });logger -p local4.info ["LOCAL|`grep IPADDR /etc/sysconfig/network-scripts/ifcfg-eth0|sed ‘s/IPADDR=//g‘`" -- "SSH|$SSH_CONNECTION $SSH_TTY" -- "USER|$USER" -- "PWD|$PWD"]: "$msg"; }‘
这里的网卡名字要根据实际情况来修改
重启服务
service rsyslog restart
原文：http://www.cnblogs.com/fujinzhou/p/5726215.html