码迷,mamicode.com
首页 > 其他好文 > 详细

rsyslog

时间:2018-01-27 15:25:11      阅读:327      评论:0      收藏:0      [点我收藏+]

标签:install   splay   new   emd   send   include   ati   compute   system   

Rsyslog简介

rsyslog是一个开源工具,被广泛用于Linux系统以通过TCP/UDP协议转发或接收日志消息。rsyslog守护进程可以被配置成两种环境,一种是配置成日志收集服务器,rsyslog进程可以从网络中收集其它主机上的日志数据,这些主机会将日志配置为发送到另外的远程服务器。rsyslog的另外一个用法,就是可以配置为客户端,用来过滤和发送内部日志消息到本地文件夹(如/var/log)或一台可以路由到的远程rsyslog服务器上。

安装Rsyslog守护进程

  1. yum install rsyslog

Server端配置

  1. [root@opm log]# grep -v "^#" /etc/rsyslog.conf | grep -v "^$"
  2. $ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
  3. $ModLoad imjournal # provides access to the systemd journal
  4. $ModLoad immark # provides --MARK-- message capability
  5. $ModLoad imudp
  6. $UDPServerRun 514
  7. $ModLoad imtcp
  8. $InputTCPServerRun 514
  9. $WorkDirectory /var/lib/rsyslog
  10. $AllowedSender tcp, 192.168.30.0/24
  11. $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
  12. $template Remote,"/data/log/%fromhost-ip%/%fromhost-ip%_%$YEAR%-%$MONTH%-%$DAY%.log"
  13. :fromhost-ip, !isequal, "127.0.0.1" ?Remote
  14. $IncludeConfig /etc/rsyslog.d/*.conf
  15. $OmitLocalLogging on
  16. $IMJournalStateFile imjournal.state
  17. *.info;mail.none;authpriv.none;cron.none /data/log/messages
  18. authpriv.* /var/log/secure
  19. mail.* -/var/log/maillog
  20. cron.* /var/log/cron
  21. *.emerg :omusrmsg:*
  22. uucp,news.crit /var/log/spooler
  23. local7.* /var/log/boot.log

a.template Remote,"/data/log/%fromhost-ip%/%fromhost-ip%_%MONTH%-%InputTCPServerRun 514 开启tcp,tcp和udp 可以共存的

Client端配置

  1. [root@test1 ~]# grep -v "^$" /etc/rsyslog.conf | grep -v "^#"
  2. $ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
  3. $ModLoad imjournal # provides access to the systemd journal
  4. $WorkDirectory /var/lib/rsyslog
  5. $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
  6. $IncludeConfig /etc/rsyslog.d/*.conf
  7. $OmitLocalLogging on
  8. $IMJournalStateFile imjournal.state
  9. *.info;mail.none;authpriv.none;cron.none @@192.168.30.55
  10. authpriv.* /var/log/secure
  11. mail.* -/var/log/maillog
  12. cron.* /var/log/cron
  13. *.emerg :omusrmsg:*
  14. uucp,news.crit /var/log/spooler
  15. local7.* /var/log/boot.log
  16. $template myFormat,"%timestamp% %fromhost-ip%%msg%\n"
  17. $ActionFileDefaultTemplate myFormat

验证,在服务器上进到 /data/log 目录下,进行查看。

收集系统其它服务日志.

  1. [root@node1 ~]# egrep -v ‘^#|^$‘ /etc/rsyslog.conf
  2. $ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
  3. $ModLoad imjournal # provides access to the systemd journal
  4. $ModLoad immark # provides --MARK-- message capability
  5. $WorkDirectory /var/lib/rsyslog
  6. $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
  7. $IncludeConfig /etc/rsyslog.d/*.conf
  8. $OmitLocalLogging on
  9. $IMJournalStateFile imjournal.state
  10. *.info;mail.none;authpriv.none;cron.none @@192.168.30.67
  11. authpriv.* /var/log/secure
  12. mail.* -/var/log/maillog
  13. cron.* /var/log/cron
  14. *.emerg :omusrmsg:*
  15. uucp,news.crit /var/log/spooler
  16. local7.* /var/log/boot.log
  17. module(load="imfile" PollingInterval="5")
  18. $InputFileName /var/log/nova/nova-compute.log
  19. $InputFileTag nova-info:
  20. $InputFileStateFile state-nova-info
  21. $InputRunFileMonitor

其实只添加了后5行的内容,对每项简单解释下

module(load="imfile" PollingInterval="5")        加载imfile 模块,并5秒刷新一次
InputFileTag nova-info:                 定义文件标签 ,注意最后是冒号:
InputRunFileMonitor                  激活读取,可以设置多组日志读取,每组结束时设置本参数

rsyslog

标签:install   splay   new   emd   send   include   ati   compute   system   

原文地址:https://www.cnblogs.com/caoxiaojian/p/35e79e17d93764d63e2721cfe240fb88.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!