注意:rsyslog 源码安装 会出现日志重复发的情况,需要rpm包安装

时间：2024-01-06 15:32:32
cd /etc/yum.repos.d;wget http://rpms.adiscon.com/v8-stable/rsyslog.repo

uat-web02:/etc/yum.repos.d# ls -ltr

total 32

-rw-r--r--. 1 root root 4528 Dec  1  2013 CentOS-Vault.repo

-rw-r--r--. 1 root root  630 Dec  1  2013 CentOS-Media.repo

-rw-r--r--. 1 root root  638 Dec  1  2013 CentOS-Debuginfo.repo

-rw-r--r--  1 root root  227 Apr  1  2014 rsyslog.repo

-rw-r--r--. 1 root root 1083 Jul  2  2014 epel.repo

-rw-r--r--. 1 root root 2572 Jul  2  2014 CentOS-Base.repo

-rw-r--r--  1 root root 1250 Aug 26  2014 puppetlabs.repo

uat-web02:/etc/yum.repos.d# cat rsyslog.repo

[rsyslog_v8]

name=Adiscon CentOS-$releasever - local packages for $basearch

baseurl=http://rpms.adiscon.com/v8-stable/epel-$releasever/$basearch

enabled=1

gpgcheck=0

gpgkey=http://rpms.adiscon.com/RPM-GPG-KEY-Adiscon

protect=1

uat-web02:/etc/yum.repos.d# ps -ef | grep rsyslog

root     32378 31761  0 09:29 pts/0    00:00:00 grep rsyslog

uat-web02:/etc/yum.repos.d# service rsyslog start

Starting system logger:                                    [  OK  ]

uat-web02:/etc/yum.repos.d# rsyslogd -v

rsyslogd 8.21.0, compiled with:

	PLATFORM:				x86_64-redhat-linux-gnu

	PLATFORM (lsb_release -d):

	FEATURE_REGEXP:				Yes

	GSSAPI Kerberos 5 support:		No

	FEATURE_DEBUG (debug build, slow code):	No

	32bit Atomic operations supported:	Yes

	64bit Atomic operations supported:	Yes

	memory allocator:			system default

	Runtime Instrumentation (slow code):	No

	uuid support:				Yes

	Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.

安装rsyslog日志搜集

yum install rsyslog

查看版本信息

yum info rsyslog

修改配置文件：

[root@Server2 yum.repos.d]# cat /etc/rsyslog.conf |egrep -v "^(#|$)"

module(load="imuxsock") # provides support for local system logging (e.g. via logger command)

module(load="imklog")   # provides kernel logging support (previously done by rklogd)

module(load="imudp") # needs to be done just once

input(type="imudp" port="514")

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$IncludeConfig /etc/rsyslog.d/*.conf

*.info;mail.none;authpriv.none;cron.none                /var/log/messages

authpriv.*                                              /var/log/secure

mail.*                                                  /var/log/maillog

cron.*                                                  /var/log/cron

*.emerg                                                 :omusrmsg:*

uucp,news.crit                                          /var/log/spooler

local7.*                                                /var/log/boot.log

$template TmplAuth, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"

$template TmplMsg, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"

authpriv.* ?TmplAuth

*.info,mail.none,authpriv.none,cron.none ?TmplMsg

创建日志保存路径

mkdir -p /var/log/rsyslog_custom

semanage fcontext -a -t syslogd_exec_t /sbin/rsyslogd

restorecon /sbin/rsyslogd

/usr/sbin/semanage fcontext -a -t var_log_t "/var/log/rsyslog_custom(/.*)?"

/sbin/restorecon -R -v /var/log/rsyslog_custom

service rsyslog restart

查看udp 514端口是否开放

客户端安装rsyslog

cd /etc/yum.repos.d;wget http://rpms.adiscon.com/v8-stable/rsyslog.repo

yum install rsyslog

修改配置文件：

[root@Server1 yum.repos.d]# cat /etc/rsyslog.conf |egrep -v "^(#|$)"

module(load="imuxsock") # provides support for local system logging (e.g. via logger command)

module(load="imklog")   # provides kernel logging support (previously done by rklogd)

module(load="imfile")

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$IncludeConfig /etc/rsyslog.d/*.conf

*.info;mail.none;authpriv.none;cron.none                /var/log/messages

authpriv.*                                              /var/log/secure

mail.*                                                  /var/log/maillog

cron.*                                                  /var/log/cron

*.emerg                                                 :omusrmsg:*

uucp,news.crit                                          /var/log/spooler

local7.*                                                /var/log/boot.log

*.info                                                  /var/log/test.log

input(type="imfile"

File="/usr/local/nginx/logs/icms.access.log"

Tag="icms-access"

Severity="info"

Facility="local5")  

*.* @192.168.0.103:514

验证：

在/var/log/rsyslog_custom目录下面：按服务器名称生成的文件夹，查看里面日志

注意:rsyslog 源码安装 会出现日志重复发的情况,需要rpm包安装

相关文章