centos7，客户端和服务端使用rsyslog进行日志传输

最新推荐文章于 2024-07-02 21:06:35 发布

短腿长颈鹿小姐

最新推荐文章于 2024-07-02 21:06:35 发布

阅读量2.1k

点赞数

分类专栏： CentOs ELK rsyslog

本文链接：https://blog.csdn.net/qq_40673345/article/details/103860339

版权

本文介绍了如何在CentOS7系统中，利用rsyslog作为客户端和服务端进行日志传输，并在日志传输正常后，如何平滑地将服务端替换为logstash进行日志收集。在转换过程中，提到了可能遇到的514端口冲突问题及解决办法。

摘要由CSDN通过智能技术生成

客户端配置rsyslog（centos自带rsyslog，不需要另外下载）

vim /etc/rsyslog.conf

#### MODULES ####

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability
$ModLoad imfile #load the dimfile module
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514


#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

$OmitLocalLogging on

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.(内核)
kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!(记录的内核消息、各种服务的公共消息，报错信息等)
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.(包含验证和授权方面信息)
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.(包含来着系统运行电子邮件服务器的日志信息)
mail.*                                                  -/var/log/maillog


# Log cron stuff(每当cron进程开始一个工作时，就会将相关信息记录在这个文件中)
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages