使用syslog-ng记录udp日志

1. 安装syslog-ng

    sudo apt-get install syslog-ng

 

2. 配置syslog-ng

 

cd /etc/syslog-ng/
cp syslog-ng.conf syslog-ng.conf_ori
echo "" >syslog-ng.conf
vi /etc/syslog-ng/syslog-ng.conf

 参考syslog-ng.conf_ori做配置，为了可以通过，将filter注释掉

@version: 3.2 

source test {
    udp(ip(0.0.0.0) port(514));
};

destination d_test{ 
    file("/home/gavingeng/tmp/$YEAR-$MONTH-$DAY.log" owner(gavingeng) group(gavingeng) perm(0600) dir_perm(0700) create_dirs(yes)); 
};

#filter f_test {
#   level(debug);
#};

log {
    source(test);
#   filter(f_test);
    destination(d_test);
};

 

3. 重启syslog-ng服务

service syslog-ng restart

 4. 查看514udp端口

netstat -nupl|grep 514
udp        0      0 0.0.0.0:514             0.0.0.0:*                           1533/syslog-ng

 

5. 这时我们可以做个测试，灌些日志进去测试

    用c来发socket不太会，就写了个python脚本来发udp socket

#!/usr/bin/env python
#coding:utf-8
#filename:socket_log.py

'''
author: gavingeng
date:   2012-01-18 18:15:13 
'''
import socket
import sys 
import traceback

def main():
    pass

def sendMsg(msg):
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.connect(('127.0.0.1',514))
        sock.sendall(msg)
        sock.close()
    except Exception,e:
        print traceback.print_exc(e)

if __name__=='__main__':
    if len(sys.argv) < 2 : 
        print "please input message"
    msg=sys.argv[1]
    sendMsg(str(msg))

 

然后在shell中执行:

for((i=0;i<1000;i++));do value=`echo "$i"|md5sum`;val="$i-----$value";python socket_log.py $val;done

 

6. 查看日志即可

 

后续可以按照项目要求进行及规范格式进行处理