centos6-rsyslog使用

Posted on Edited on Views:

syslog是一种广泛应用在unix/linux等设备上的日志传输协议 。如何采集各个机器的日志到日志集中存储及分析,通过rsyslog发送到rsyslog日志接收端，在进行解析接存储到数据库在分析

rsyslog

env

  • centos6.x 2c4g x3
  • rsyslog
  • disable iptables

plan

  • 172.24.20.51 rsyslog-sever
  • 172.24.20.50/52 rsyslog-sender

1.disable iptables

service iptables stop && chkconfig iptables off

2.install rsyslog

# check installed
rpm -qa |grep rsyslog

[root@c6-172-24-20-50 ~]# rpm -ql rsyslog |grep etc
/etc/logrotate.d/syslog
/etc/pki/rsyslog
/etc/rc.d/init.d/rsyslog

/etc/rsyslog.conf
/etc/rsyslog.d
/etc/sysconfig/rsyslog

default already installed

3.cofnig server

#add args

vim /etc/sysconfig/rsyslog
#SYSLOGD_OPTIONS="-c 5"
SYSLOGD_OPTIONS="-m 0 -r"

#config

1
2
3
4
5
6
7
8
9
10
11
12
13
/etc/rsyslog.conf

#### MODULES ####
$ModLoad imtcp
$InputTCPServerRun 514

#### GLOBAL DIRECTIVES ####
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$template Remote, "/opt/log/%fromhost-ip%/%fromhost-ip%_%$YEAR%-%$MONTH%-%$DAY%.log"
:fromhost-ip, !isequal, "127.0.0.1" ?Remote
& ~

#restart rsyslog

service rsyslog start|stop|restart|status

4.config client

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# add send all log to server
vim /etc/rsyslog.conf

#send all log
#*.*     @172.24.20.51    # @172.24.20.51:514 @是udp协议
#*.*     @@172.24.20.51   # @@172.24.20.51:514 @@是tcp协议

# ### begin forwarding rule ###

$WorkDirectory /var/lib/rsyslog # where to place spool files
$ActionQueueFileName fwdRule1 # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
$ActionQueueType LinkedList   # run asynchronously
$ActionResumeRetryCount -1    # infinite retries if host is down

*.* @@172.24.20.51:514
# ### end of the forwarding rule ###

#restart rsyslog

service rsyslog restart

5.testing

[root@c6-172-24-20-51 ~]# cd /opt/log/
[root@c6-172-24-20-51 log]# ll
total 8
drwx------ 2 root root 4096 Feb 23 17:59 172.24.20.50
drwx------ 2 root root 4096 Feb 23 21:21 172.24.20.52
[root@c6-172-24-20-51 log]# ll 172.24.20.50/
total 260
-rw------- 1 root root 264776 Feb 23 22:03 172.24.20.50_2022-02-23.log

tail -F 172.24.20.50_2022-02-23.log

restart 20.50/ retry login linux