rsyslog

1. 新安装的centos 7， 查看一下版本：

rsyslogd -v 

如果不是版本8 以上进行以下操作：

shell> cd /etc/yum.repos.d/
shell> wget http://rpms.adiscon.com/v8-stable/rsyslog.repo
shell> yum install rsyslog

2.  确认是否安装了 librelp ：

 yum install librelp

3. 安装relp模块：

yum install rsyslog-relp

4. 如果安装有syslog的话，在启动rsyslog之前先关闭它：

service syslog stop

5.  vi /etc/rsyslog.conf :

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

$WorkDirectory /var/lib/rsyslog
$MainMsgQueueFileName rsyslog.queue
$MainMsgQueueSaveOnShutdown on
$MainMsgQueueType LinkedList
$MainMsgQueueMaxFileSize 500m

$IncludeConfig /home/open/conf/rsyslog/*.conf

6. vi /home/open/conf/rsyslog/client.conf :

module(load="omrelp")
module(load="imfile")

$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0
$RepeatedMsgReduction off
$MaxMessageSize 64k

ruleset(name="send" queue.size="1000000" queue.filename="traffic.main.queue"
queue.highwatermark="800000" queue.lowwatermark="200000"
queue.discardmark="800000" queue.workerthreads="8"
queue.MaxFileSize="2g" queue.WorkerThreadMinimumMessages="100000"){
*.* action(type="omrelp"
           target="127.0.0.1"
           port="5140"
           queue.type="LinkedList"
           action.ResumeRetryCount="-1"
           queue.FileName="rsyslog.global.tmp"
           queue.SaveOnShutdown="on")
    stop
}

input(type="imfile"
      Ruleset="send"
      Tag="game.txt"
      File="/home/open/var/log/game/version*")

7. vi /home/open/conf/rsyslog/server.conf :

module(load="imrelp")

$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0
$RepeatedMsgReduction off
$MaxMessageSize 64k

template(name="file" type="string" string="/home/open/var/dest/%$YEAR%-%$MONTH%-%$DAY%/%fromhost-ip%/%syslogtag%")
template(name="msgonly" type="string" string="%msg%\n")

ruleset(name="receive"
        queue.size="1000000"
        queue.filename="traffic.main.queue"
        queue.highwatermark="800000"
        queue.lowwatermark="200000"
        queue.discardmark="800000"
        queue.workerthreads="8"
        queue.WorkerThreadMinimumMessages="100000"
        queue.MaxFileSize="2g"){

*.* action(type="omfile"
           dynaFile="file"
           template="msgonly"
           queue.type="LinkedList"
           action.ResumeRetryCount="-1"
           queue.SaveOnShutdown="on"
           queue.FileName="rsyslog.queue.receive"
           CreateDirs="on"
           DirCreateMode="0755")
    stop
}

input(type="imrelp" port="5140" Ruleset="receive")

8 . 测试配置文件是否正确：

rsyslogd -f /etc/rsyslog.conf -N1

9. 

service rsyslog restart
service rsyslog stop
service rsyslog start