首先我们来配置主机:
编辑rsyslog配置文件,路径 /etc/rsyslog.conf,修改前最好先备份一份,修改后的文件内容如下
grep -v “^#” /etc/rsyslog.conf | grep -v “^$”
文件内容如下:
服务端
#start
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
$ModLoad imtcp
$InputTCPServerRun 514
$WorkDirectory /var/lib/rsyslog
$template myformat, “%TIMESTAMP:1:10:date-rfc3339% %TIMESTAMP:19:12:date-rfc3339% %hostname% %syslogtag%%msg%\n”
$ActionFileDefaultTemplate myformat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
t
e
m
p
l
a
t
e
D
e
b
u
g
,
"
/
d
a
t
a
/
s
h
a
r
e
/
l
o
g
/
template Debug, "/data/share/log/%fromhost-ip%/xcoder_debug_%
templateDebug,"/data/share/log/YEAR%-%
M
O
N
T
H
MONTH%-%
MONTHDAY%.log"
t
e
m
p
l
a
t
e
I
n
f
o
,
"
/
d
a
t
a
/
s
h
a
r
e
/
l
o
g
/
template Info, "/data/share/log/%fromhost-ip%/xcoder_info_%
templateInfo,"/data/share/log/YEAR%-%
M
O
N
T
H
MONTH%-%
MONTHDAY%.log"
if $fromhost-ip != ‘127.0.0.1’ and $syslogfacility-text == ‘local1’ then ?Debug
& ~
if $fromhost-ip != ‘127.0.0.1’ then ?Info
& ~
.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv. /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
.emerg :omusrmsg:
uucp,news.crit /var/log/spooler
local1.* /var/log/xcoder.debug
local0.* /var/log/xcoder.info
local7.* /var/log/boot.log
#end
客户端配置:
#start
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
$WorkDirectory /var/lib/rsyslog
$template myformat,“%TIMESTAMP:1:10:date-rfc3339% %TIMESTAMP:19:12:date-rfc3339% %hostname% %syslogtag%%msg%\n”
$ActionFileDefaultTemplate myformat
$IncludeConfig /etc/rsyslog.d/.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv. /var/log/secure
mail. -/var/log/maillog
cron.* /var/log/cron
.emerg :omusrmsg:
uucp,news.crit /var/log/spooler
local1.* /var/log/xcoder.debug
local0.* /var/log/xcoder.info
local7.* /var/log/boot.log
local0.* @@服务端IP;RSYSLOG_ForwardFormat
local1.* @@服务端IP;RSYSLOG_ForwardFormat
$imjournalRatelimitInterval 30
$imjournalRatelimitBurst 10000
#end