1.Rsyslog介绍
Rsyslog is Rocket-fast System for Log processing.Rsyslog是CentOS6系列默认的日志处理软件。Rsyslog基于模块化设计，提供高性能，安全的日志处理系统。Rsyslog是多线程的，支持TCP,UDP,TLS,RELP.Rsyslog实际上syslog的一个增强版本。
2.安装Rsyslog
CentOS下默认已经安装了rsyslog
查看rsyslog运行状态
$service rsyslog status
rsyslogd (pid 7542) is running...
$ ps -ef|grep rsyslog|grep -v grep
root 1014 1 0 2014 ? 00:15:09 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
这里-c 5 是在/etc/sysconfig/rsyslog中定义的
$ cat /etc/sysconfig/rsyslog
# Options for rsyslogd
# Syslogd options are deprecated since rsyslog v3.
# If you want to use them, switch to compatibility mode 2 by "-c 2"
# See rsyslogd(8) for more details
SYSLOGD_OPTIONS="-c 5"3.配置rsyslog
rsyslog的配置文件/etc/rsyslog.conf
# rsyslog v5 configuration file
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html
#### MODULES ####
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
#$ModLoad immark # provides --MARK-- message capability
# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514
# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514
#### GLOBAL DIRECTIVES ####
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on
# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf
#### RULES ####
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$WorkDirectory /var/lib/rsyslog # where to place spool files
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList # run asynchronously
#$ActionResumeRetryCount -1 # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# ### end of the forwarding rule ###$ cat /etc/rsyslog.conf|grep -v -E "^#|^$"
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg *
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log配置格式如下：
日志类型.日志级别 日志处理方式
| 日志类型 | 说明 |
| auth | pam模块产生的日志 |
| authpriv | ssh,sftp等的登录验证信息 |
| cron | 定时任务相关日志 |
| kernel | 内核相关日志 |
| lpr | 打印日志 |
| mail | 邮件相关日志 |
| news | 新闻组 |
| user | 用户程序产生的日志 |
| local 1-7 | 自定义的日志设备 |
| 日志级别 | 说明 | 级别值 |
| debug | 调试信息 | 7 |
| info | 一般信息 | |
| notice | 普通信息 | |
| warning | 警告信息 | 4 |
| err | 错误信息 | |
| crit | 严重信息 | |
| alert | 告警信息 | |
| emerg | 紧急信息 | |
| none |
| 连接符合 | 说明 |
| .xxx | 表示大于或等于xxx级别的信息 |
| .=xxx | 表示等于xxx级别的信息 |
| .!xxx | 除了xxx级别的信息 |
日志处理方式
# 记录到普通文件或设备文件
*.* /var/log/file.log # 绝对路径
*.* /dev/pts/0
# 测试:
# logger 命令用于产生日志
logger -p local3.info 'KadeFor is testing the rsyslog and logger'
# 转发到远程
*.* @192.168.0.1 # 使用UDP协议转发到192.168.0.1的514(默认)端口
*.* @@192.168.0.1:10514 # 使用TCP协议转发到192.168.0.1的10514(默认)端口
# 发送给用户(需要在线才能收到)
*.* root
*.* root,kadefor,up01 # 使用,号分隔多个用户
*.* * # *号表示所有在线用户
# 忽略,丢弃
local3.* ~ # 忽略所有local3类型的所有级别的日志
# 执行脚本
local3.* ^/tmp/a.sh # ^号后跟可执行脚本或程序的绝对路径
# 日志内容可以作为脚本的第一个参数.
# 可用来触发报警日志的记录有先后顺序
# Save boot messages also to boot.log
local7.* /var/log/boot.log
local3.* /var/log/local3.log添加一行，然后执行service rsyslogd restart
然后执行
$ logger -p local3.info 'KadeFor is testing the rsyslog and logger'
在查看日志
$ sudo tail -f /var/log/local3.log
Feb 25 16:28:06 xxxx xxx: KadeFor is testing the rsyslog and logger
# 过滤日志, 由:号开头
:msg, contains, "error" /var/log/error.log
:msg, contains, "error" ~ # 忽略包含error的日志
:msg, contains, "user nagios" ~
:msg, contains, "user kadefor" ~
:msg, contains, "module-alsa-sink.c: ALSA woke us up to write new data to the device, but there was actually nothing to write" ~
local3.* ~
# PS.
& ~ # 忽略所有的日志$template myFormat,"%rawmsg%n"
$ActionFileDefaultTemplate myFormat
#如果不要$ActionFileDefaultTemplate myFormat这一行, 就需要像这样来使用模板:
#在日志文件后添加模板名, 并用;号分隔
$template myFormat,"%rawmsg%n"
# The authpriv file has restricted access.
authpriv.* /var/log/secure;myFormat
# Log all the mail messages in one place.
mail.* /var/log/maillog;myFormat
# Log cron stuff
cron.* /var/log/cron;myFormat
# Everybody gets emergency messages
*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler;myFormat
# Save boot messages also to boot.log
local7.* /var/log/boot.log;myFormat# 只要在rsyslog.conf中加入
*.* @192.168.0.10
*.* @192.168.0.10:10514 # 带端口号
*.* @@192.168.0.10 # TCP
使用一个@表示UDP，两个@@表示TCP配置远程发送接收syslog日志
案例1：
客户端：
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
*.* @@10.10.41.17:514
# ### end of the forwarding rule ###这里设置将所有的日志都通过TCP方式发送到远程的rsyslog服务器
然后执行
service rsyslog restart
服务端：
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514然后执行
service rsyslog restart
现在客户端的rsyslog日志就可以直接发送一份到服务端
案例2：
客户端：
:rawmsg,contains,"sdns_log" @@10.10.41.17
:rawmsg,contains,"sdns_log" ~前面讲过rsyslog的日志记录是有先后顺序的，这里将包含sdns_log的日志先发送到服务端，然后本地丢弃
重新启动rsyslog
服务端：
# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514
$template logformat,"%TIMESTAMP:::date-mysql% %FROMHOST-IP%%msg%n"
$template DynFile,"/var/log/tlog%$year%%$month%%$day%.log"
:rawmsg,contains,"sdns_log" ?DynFile;logformat
:rawmsg,contians,"sdns_log" ~然后执行
service rsyslog restart
客户端测试：
$ logger -p user.info "sdns_log 34334"
查看服务端日志
$ sudo tail -f /var/log/tlog20150227.log
20150227113413 10.10.41.20 sdns_log 34334n
把不同服务器发送过来的日志存放到不同的文件
:fromhost-ip, isequal, "192.168.0.160" /var/log/host160.log
:FROMHOST-IP, isequal, "192.168.0.161" /var/log/host161.log
:FROMHOST-IP, startswith, "192.168.1." /var/log/network1.log
:FROMHOST-IP, startswith, "192.168.2." /var/log/network2.log案例3
自定义修改ssh的日志记录
修改ssh的配置文件/etc/ssh/sshd_config
SyslogFacility local5
这里将ssh的日志类型设置为local5，默认是AUTHPRIV
然后重新加载sshd
修改/etc/rsyslog.conf
添加
local5.* /var/log/sshd.log
将local5类型的日志记录到/var/log/sshd.log这个文件
然后重新启动rsyslog
查看日志
案例4
将mail日志保存到远程服务器的/var/log/newmail.log文件
参考文档：
http://www.rsyslog.com/doc/v5-stable/
http://w.gdu.me/wiki/Linux/rsyslog_logrotate.html
转载于:https://blog.51cto.com/john88wang/1614797
扫一扫
8215
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
