1. 新安装的centos 7, 查看一下版本:
rsyslogd -v
如果不是版本8 以上进行以下操作:
shell> cd /etc/yum.repos.d/
shell> wget http://rpms.adiscon.com/v8-stable/rsyslog.repo
shell> yum install rsyslog
2. 确认是否安装了 librelp :
yum install librelp
3. 安装relp模块:
yum install rsyslog-relp
4. 如果安装有syslog的话,在启动rsyslog之前先关闭它:
service syslog stop
5. vi /etc/rsyslog.conf :
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/lib/rsyslog
$MainMsgQueueFileName rsyslog.queue
$MainMsgQueueSaveOnShutdown on
$MainMsgQueueType LinkedList
$MainMsgQueueMaxFileSize 500m
$IncludeConfig /home/open/conf/rsyslog/*.conf
6. vi /home/open/conf/rsyslog/client.conf :
module(load="omrelp")
module(load="imfile")
$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0
$RepeatedMsgReduction off
$MaxMessageSize 64k
ruleset(name="send" queue.size="1000000" queue.filename="traffic.main.queue"
queue.highwatermark="800000" queue.lowwatermark="200000"
queue.discardmark="800000" queue.workerthreads="8"
queue.MaxFileSize="2g" queue.WorkerThreadMinimumMessages="100000"){
*.* action(type="omrelp"
target="127.0.0.1"
port="5140"
queue.type="LinkedList"
action.ResumeRetryCount="-1"
queue.FileName="rsyslog.global.tmp"
queue.SaveOnShutdown="on")
stop
}
input(type="imfile"
Ruleset="send"
Tag="game.txt"
File="/home/open/var/log/game/version*")
7. vi /home/open/conf/rsyslog/server.conf :
module(load="imrelp")
$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0
$RepeatedMsgReduction off
$MaxMessageSize 64k
template(name="file" type="string" string="/home/open/var/dest/%$YEAR%-%$MONTH%-%$DAY%/%fromhost-ip%/%syslogtag%")
template(name="msgonly" type="string" string="%msg%\n")
ruleset(name="receive"
queue.size="1000000"
queue.filename="traffic.main.queue"
queue.highwatermark="800000"
queue.lowwatermark="200000"
queue.discardmark="800000"
queue.workerthreads="8"
queue.WorkerThreadMinimumMessages="100000"
queue.MaxFileSize="2g"){
*.* action(type="omfile"
dynaFile="file"
template="msgonly"
queue.type="LinkedList"
action.ResumeRetryCount="-1"
queue.SaveOnShutdown="on"
queue.FileName="rsyslog.queue.receive"
CreateDirs="on"
DirCreateMode="0755")
stop
}
input(type="imrelp" port="5140" Ruleset="receive")
8 . 测试配置文件是否正确:
rsyslogd -f /etc/rsyslog.conf -N1
9.
service rsyslog restart
service rsyslog stop
service rsyslog start