如何在Ubuntu 20.04上使用日志记录集中日志

介绍 (Introduction)

System logs are an extremely important component of managing Linux systems. They provide an invaluable insight into how the systems are working and also how they are being used because, in addition to errors, they record operational information such as security events. The standard configuration for Linux systems is to store their logs locally on the same system where they occurred. This works for standalone systems but quickly becomes a problem as the number of systems increases. The solution to managing all these logs is to create a centralized logging server where each Linux host sends its logs, in real-time, to a dedicated log management server.

系统日志是管理Linux系统的极其重要的组成部分。 它们提供了有关系统如何工作以及如何使用它们的宝贵见解，因为它们除了记录错误外，还记录诸如安全事件之类的操作信息。 Linux系统的标准配置是将日志本地存储在发生日志的同一系统上。 这适用于独立系统，但是随着系统数量的增加很快成为问题。 管理所有这些日志的解决方案是创建一个集中式日志服务器，每个Linux主机在其中将其日志实时发送到专用日志管理服务器。

A centralized logging solution offers several benefits compared with storing logs on each host:

与将日志存储在每个主机上相比，集中式日志记录解决方案具有多个优点：

• Reduces the amount of disk space needed on each host to store log files.
  减少每个主机上存储日志文件所需的磁盘空间量。
• Logs can be retained for longer as the dedicated log server can be configured with more storage capacity.
  可以将日志保留更长的时间，因为可以为专用日志服务器配置更多的存储容量。
• Advanced log analysis can be carried out that requires logs from multiple systems and also more compute resources than may be available on the hosts.
  可以执行高级日志分析，这需要来自多个系统的日志，并且还需要比主机上可用的计算资源更多的计算资源。
• Systems administrators can access the logs for all their systems that they may not be able to log in to directly for security reasons.
  系统管理员可以访问他们出于安全原因可能无法直接登录的所有系统的日志。

In this guide, you will configure a component of the systemd suite of tools to relay log messages from client systems to a centralized log collection server. You will configure the server and client to use TLS certificates to encrypt the log messages as they are transmitted across insecure networks such as the internet and also to authenticate each other.

在本指南中，您将配置systemd工具套件的组件，以将日志消息从客户端系统中继到集中式日志收集服务器。 您将配置服务器和客户端使用TLS证书来加密日志消息，因为它们是通过不安全的网络(例如Internet)传输的，并且还可以彼此进行身份验证。

先决条件 (Prerequisites)

Before you begin this guide you’ll need the following:

在开始本指南之前，您需要满足以下条件：

• Two Ubuntu 20.04 servers.
  两台Ubuntu 20.04服务器。

• A non-root user with sudo privileges on both servers. Follow the Initial Server Setup with Ubuntu 20.04 guide for instructions on how to do this. You should also configure the UFW firewall on both servers as explained in the guide.

  两台服务器上均具有sudo特权的非root用户。 请遵循《 Ubuntu 20.04初始服务器设置》指南中有关如何执行此操作的说明。 您还应该按照指南中的说明在两台服务器上配置UFW防火墙。

• Two hostnames that point to your servers. One hostname for the client system that generates the logs and another one for the log collection server. Learn how to point hostnames to DigitalOcean Droplets by consulting the Domains and DNS documentation.

  指向您的服务器的两个主机名。 用于生成日志的客户端系统的一个主机名，以及用于日志收集服务器的另一个主机名。 通过查询域和DNS文档，了解如何将主机名指向DigitalOcean Droplet。

This guide will use the following two example hostnames:

本指南将使用以下两个示例主机名：

• client.your_domain: The client system that generates the logs.

  client.your_domain ：生成日志的客户端系统。

• server.your_domain: The log collection server.

  server.your_domain ：日志收集服务器。

Log in to both the client and server in separate terminals via SSH as the non-root sudo user to begin this tutorial.

以非root用户sudo用户身份通过​​SSH登录到单独终端中的客户端和服务器，以开始本教程。

Note: Throughout the tutorial command blocks are labeled with the server name (client or server) that the command should be run on.

注意 ：在整个教程命令块中，均标有应在其上运行命令的服务器名称( client或server )。

第1步-安装systemd-journal-remote (Step 1 — Installing systemd-journal-remote)

In this step, you will install the systemd-journal-remote package on the client and the server. This package contains the components that the client and server use to relay log messages.

在此步骤中，您将在客户端和服务器上安装systemd-journal-remote软件包。 该软件包包含客户端和服务器用来中继日志消息的组件。

First, on both the client and server, run a system update to ensure that the package database and the system is current:

首先，在客户端和服务器上 ，运行系统更新以确保软件包数据库和系统是最新的：

Client and Server

客户端和服务器

• sudo apt update
  sudo apt更新
• sudo apt upgrade
  sudo apt升级

Next, install the systemd-journal-remote package:

接下来，安装systemd-journal-remote软件包：

Client and Server

客户端和服务器

• sudo apt install systemd-journal-remote
  须藤apt install systemd-journal-remote

On the server, enable and start the two systemd components that it needs to receive log messages with the following command:

在服务器上 ，使用以下命令启用并启动接收日志消息所需的两个