Rsyslog简介
rsyslog是一个开源工具,被广泛用于Linux系统以通过TCP/UDP协议转发或接收日志消息。rsyslog守护进程可以被配置成两种环境,一种是配置成日志收集服务器,rsyslog进程可以从网络中收集其它主机上的日志数据,这些主机会将日志配置为发送到另外的远程服务器。rsyslog的另外一个用法,就是可以配置为客户端,用来过滤和发送内部日志消息到本地文件夹(如/var/log)或一台可以路由到的远程rsyslog服务器上。
安装Rsyslog守护进程
yum install rsyslog
Server端配置
[root@opm log]# grep -v "^#" /etc/rsyslog.conf | grep -v "^$"
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
$ModLoad immark # provides --MARK-- message capability
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
$WorkDirectory /var/lib/rsyslog
$AllowedSender tcp, 192.168.30.0/24
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$template Remote,"/data/log/%fromhost-ip%/%fromhost-ip%_%$YEAR%-%$MONTH%-%$DAY%.log"
:fromhost-ip, !isequal, "127.0.0.1" ?Remote
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
*.info;mail.none;authpriv.none;cron.none /data/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
a.允许网段内的主机以协议来传输AllowedSendertcp,192.168.30.0/24允许30.0网段内的主机以tcp协议来传输b.template Remote,"/data/log/%fromhost-ip%/%fromhost-ip%_%YEARMONTH%-%过滤本机的日志。DAYc.:fromhost−ip,!isequal,"127.0.0.1"?Remote过滤server本机的日志。d.InputTCPServerRun 514 开启tcp,tcp和udp 可以共存的
Client端配置
[root@test1 ~]# grep -v "^$" /etc/rsyslog.conf | grep -v "^#"
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
*.info;mail.none;authpriv.none;cron.none @@192.168.30.55
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
$template myFormat,"%timestamp% %fromhost-ip%%msg%\n"
$ActionFileDefaultTemplate myFormat
验证,在服务器上进到 /data/log 目录下,进行查看。
收集系统其它服务日志.
[root@node1 ~]# egrep -v '^#|^$' /etc/rsyslog.conf
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
$ModLoad immark # provides --MARK-- message capability
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
*.info;mail.none;authpriv.none;cron.none @@192.168.30.67
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
module(load="imfile" PollingInterval="5")
$InputFileName /var/log/nova/nova-compute.log
$InputFileTag nova-info:
$InputFileStateFile state-nova-info
$InputRunFileMonitor
其实只添加了后5行的内容,对每项简单解释下
module(load="imfile" PollingInterval="5") 加载imfile 模块,并5秒刷新一次
要监控的日志文件路径InputFileName/var/log/nova/nova−compute.log 要监控的日志文件路径InputFileTag nova-info: 定义文件标签 ,注意最后是冒号:
定义状态文件InputFileStateFilestate−nova−info 定义状态文件InputRunFileMonitor 激活读取,可以设置多组日志读取,每组结束时设置本参数