linux 7 rsyslog,centos7设置rsyslog日志服务集中服务器

centos7设置rsyslog日志服务集中服务器

环境：centos6.9_x86_64，自带的rsyslog版本是7.4.7，很多配置都不支持，于是进行升级后配置

# 安装新版本的rsyslog程序

wget http://rpms.adiscon.com/v8-stable/rsyslog.repo

mv rsyslog.repo /etc/yum.repos.d/rsyslog.repo

yum install rsyslog* --skip-broken

[root@:/etc]# rsyslogd -ver

rsyslogd 8.1907.0 (aka 2019.07) compiled with:

PLATFORM:x86_64-redhat-linux-gnu

PLATFORM (lsb_release -d):

FEATURE_REGEXP:Yes

GSSAPI Kerberos 5 support:Yes

FEATURE_DEBUG (debug build, slow code):No

32bit Atomic operations supported:Yes

64bit Atomic operations supported:Yes

memory allocator:system default

Runtime Instrumentation (slow code):No

uuid support:Yes

systemd support:Yes

Config file:/etc/rsyslog.conf

PID file:/var/run/syslogd.pid

Number of Bits in RainerScript integers: 64

See https://www.rsyslog.com for more information.

服务端的配置:

[root:/etc]# egrep -v '^#|^$' /etc/rsyslog.conf

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)

$ModLoad imklog # reads kernel messages (the same are read from journald)

$ModLoad imudp

$UDPServerRun 514

$ModLoad imtcp

$InputTCPServerRun 514

$WorkDirectory /var/lib/rsyslog

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$DirCreateMode 0755

$FileCreateMode 0644

$Umask 0022

$IncludeConfig /etc/rsyslog.d/*.conf

$template slog, "%$year%%$month%%$day%%$hour%%$minute% %msg:R,ERE,3,DFLT:(SLOG|ALOG|BLOG)(_[a-zA-Z0-9]+)+\s(.*)--end%\n"

$template slogfile1, "/data/www/logs/%msg:R,ERE,1,DFLT:(SLOG|ALOG|BLOG)(_[A-Z0-9]+)+\s.*--end:lowercase%/%msg:R,ERE,2,DFLT:(SLOG|ALOG|BLOG)_([A-Z0-9]+)(_[a-zA-Z0-9]+)*\s.*--end:lowercase%/%msg:R,ERE,2,DFLT:(SLOG|ALOG|BLOG)_([A-Z0-9]+(_[a-zA-Z0-9]+)*)\s.*--end:lowercase%/%$year%%$month%%$day%%$hour%%$minute%.log"

$template slogfile2, "/data/www/logs/%msg:R,ERE,2,DFLT:(BLOG)_([A-Z0-9]+)(_[a-zA-Z0-9]+)*\s.*--end:lowercase%/%msg:R,ERE,3,DFLT:(BLOG)_([A-Z0-9]+)_([a-zA-Z0-9]+)*\s.*--end:lowercase%/%$year%%$month%%$day%.log"

:msg, ereregex, "(S|A|B)LOG(_[A-Z0-9]+)+ " ?slogfile2;slog

:msg, ereregex, "(S|A|B)LOG(_[A-Z0-9]+)+ " ~

*.info;mail.none;authpriv.none;cron.none /var/log/messages

authpriv.* /var/log/secure

mail.* -/var/log/maillog

cron.* /var/log/cron

*.emerg :omusrmsg:*

uucp,news.crit /var/log/spooler

local7.* /var/log/boot.log

$ActionQueueFileName fwdRule1 # unique name prefix for spool files

$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)

$ActionQueueSaveOnShutdown on # save messages to disk on shutdown

$ActionQueueType LinkedList # run asynchronously

$MainMsgQueueDiscardMark 2000000

$MainMsgQueueHighWaterMark 1000000

$MainMsgQueueLowWaterMark 800000

$MainMsgQueueMaxDiskSpace 5g

$MainMsgQueueSize 8000000

$MainMsgQueueTimeoutEnqueue 0

$MainMsgQueueSaveOnShutdown on

# 客户端配置

[root@:~]# egrep -v '^#|^$' /etc/rsyslog.conf

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)

$ModLoad imjournal # provides access to the systemd journal

$WorkDirectory /var/lib/rsyslog

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$IncludeConfig /etc/rsyslog.d/*.conf

$OmitLocalLogging on

$IMJournalStateFile imjournal.state

*.info;mail.none;authpriv.none;cron.none /var/log/messages

authpriv.* /var/log/secure

mail.* -/var/log/maillog

cron.* /var/log/cron

*.emerg :omusrmsg:*

uucp,news.crit /var/log/spooler

# 服务端的ip地址

local7.* @172.17.0.36:514

*.* @@172.17.0.36:514

# 客户端测试：

[root@:~]# logger -t 'hello' 'jack'

# 服务端观察，看到测试日志说明配置成功

[root@:~]# tail -f /var/log/messages

Jul 19 00:01:28 eus_pe_web03 hello: jack