Linux集群利用rsyslog记录所有节点的操作指令

需求
想实现这么一个需求，假设集群中有3个节点，其中有一个master节点，使用者可以在3个节点上输入任意指令，每有一个操作，都将其操作指令实时发送到master节点，并将操作信息记录在某个特定文件中。

环境
软件/主机    版本/IP
centos    7.4-1708
master    10.XX.XX.52
worker1    10.XX.XX.51
worker2    10.XX.XX.50
操作系统安装完成之后，已自带rsyslog服务

[root@master profile.d]# systemctl status rsyslog
● rsyslog.service - System Logging Service
   Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2020-01-13 15:55:07 CST; 3 days ago
     Docs: man:rsyslogd(8)
           http://www.rsyslog.com/doc/
 Main PID: 631 (rsyslogd)
   Memory: 480.0K
   CGroup: /system.slice/rsyslog.service
           └─631 /usr/sbin/rsyslogd -n

Jan 13 15:55:07 master.node systemd[1]: Starting System Logging Service...
Jan 13 15:55:07 master.node rsyslogd[631]:  [origin software="rsyslogd" swVersion="8.24.0" x-pid="631" x-info="http://www.rsyslog.com"] start
Jan 13 15:55:07 master.node systemd[1]: Started System Logging Service.
 
查看rsyslog版本

[root@master profile.d]# rsyslogd -version
rsyslogd 8.24.0, compiled with:
    PLATFORM:                x86_64-redhat-linux-gnu
    PLATFORM (lsb_release -d):        
    FEATURE_REGEXP:                Yes
    GSSAPI Kerberos 5 support:        Yes
    FEATURE_DEBUG (debug build, slow code):    No
    32bit Atomic operations supported:    Yes
    64bit Atomic operations supported:    Yes
    memory allocator:            system default
    Runtime Instrumentation (slow code):    No
    uuid support:                Yes
    Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.
 
配置日志服务
安装RELP协议包
3个节点均安装RELP包

yum install -y rsyslog-relp
1
配置日志服务器
master节点充当日志服务器
修改配置文件/etc/rsyslog.conf，增加有关RELP两行

# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception
# $ModLoad imtcp
# $InputTCPServerRun 514

$ModLoad imrelp  #加载RELP模块
$InputRELPServerRun 2514  #传输端口
 
传输端口监听
修改配置文件/etc/sysconfig/rsyslog

# Options for rsyslogd
# Syslogd options are deprecated since rsyslog v3.
# If you want to use them, switch to compatibility mode 2 by "-c 2"
# See rsyslogd(8) for more details
SYSLOGD_OPTIONS="-r2514 -c2"
1
2
3
4
5
关闭防火墙

systemctl stop firewalld
systemctl disable firewalld
1
2
重启日志服务

systemctl restart rsyslog
1
查看服务端口状态

[root@master profile.d]# netstat -antp | grep 2514
tcp        0      0 0.0.0.0:2514            0.0.0.0:*               LISTEN      14602/rsyslogd      
tcp6       0      0 :::2514                 :::*                    LISTEN      14602/rsyslogd 
1
2
3
配置日志客户机端
以worker2节点为例
修改配置文件 /etc/rsyslog.conf

# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception
# $ModLoad imtcp
# $InputTCPServerRun 514

$ModLoad omrelp  #加载RELP模块
*.* :omrelp:10.XX.XX.52:2514  #目标主机端口
 
如果是master节点本身，则不需要再次配置目标主机端口，只需要配置后文中的收集脚本就行了

关闭防火墙

systemctl stop firewalld
systemctl disable firewalld
1
2
重启日志服务

systemctl restart rsyslog
1
查看服务端口状态

[root@worker2 opt]# netstat -antp | grep 2514
tcp       90      0 10.XX.XX.50:36516     10.XX.XX.52:2514      ESTABLISHED 1064/rsyslogd 
1
2
测试
在服务端（master节点）查看/var/log/messages日志文件

[root@master profile.d]# tail -f /var/log/messages 
1
在客户机输入测试指令

[root@worker2 opt]# logger -t kern -p error "test log nihao"
1
观察服务端日志信息

Jan 17 09:22:26 master rsyslogd: [origin software="rsyslogd" swVersion="8.24.0" x-pid="631" x-info="http://www.rsyslog.com"] exiting on signal 15.
Jan 17 09:22:26 master systemd: Starting System Logging Service...
Jan 17 09:22:26 master rsyslogd: [origin software="rsyslogd" swVersion="8.24.0" x-pid="14602" x-info="http://www.rsyslog.com"] start
Jan 17 09:22:26 master systemd: Started System Logging Service.
Jan 17 09:23:07 master systemd: Reloading.
Jan 17 09:30:45 worker2 systemd: Stopping System Logging Service...
Jan 17 09:30:45 worker2 rsyslogd: [origin software="rsyslogd" swVersion="8.24.0" x-pid="31376" x-info="http://www.rsyslog.com"] exiting on signal 15.
Jan 17 09:30:45 worker2 systemd: Starting System Logging Service...
Jan 17 09:30:45 worker2 rsyslogd: [origin software="rsyslogd" swVersion="8.24.0" x-pid="1064" x-info="http://www.rsyslog.com"] start
Jan 17 09:30:45 worker2 systemd: Started System Logging Service.
Jan 17 09:34:16 worker2 kern: test log nihao
 
测试成功。