rsyslog收集nginx日志配置
|
1
2
3
4
5
6
7
8
9
|
# yum install rsyslog -y
# vim /etc/rsyslog.conf
*.* @192.168.10.1:514
# vim /etc/bashrc #收集其他服务器的操作命令
export
PROMPT_COMMAND=
'{ msg=$(history 1 | { read x y; echo $y; });logger "[euid=$(whoami)]":$(who am i):[`pwd`]"$msg"; }'
# . /etc/bashrc
# crontab -e
*
/1
* * * *
/bin/echo
`
date
`
# service rsyslog restart
|
|
1
2
3
4
5
6
7
8
9
10
11
|
# yum install rsyslog -y
# vim /etc/rsyslog.conf
$ModLoad imudp
#启用udp，514端口收集日志
$UDPServerRun 514
$template logformat,
"%FROMHOST-IP% %structured-data% %timegenerated% %msg%\n"
#定义日志模板
$template DynFile,
"/var/log/%$year%%$month%%$day%.log"
#定义日志路径
:rawmsg, contains,
"CROND"
?DynFile;logformat
#含有"CROND"日志，输出为/var/log/%$year%%$month%%$day%.log
:rawmsg, contains,
"CROND"
~
# service rsyslog restart
# tail -f /var/log/20150212.log #查看crontab的log
# tail -f /var/log/messages #查看客户端输入的命令
|
|
1
2
|
# vim /etc/sysconfig/rsyslog
SYSLOGD_OPTIONS=
"-c 5 -Q -x"
|
|
1
2
3
4
5
6
|
# vim /etc/rsyslog.conf #把下面几行注释
#$template logformat,"%FROMHOST-IP% %structured-data% %timegenerated% %msg%\n"
#$template DynFile,"/var/log/%$year%%$month%%$day%.log"
#:rawmsg, contains, "CROND" ?DynFile;logformat
# service rsyslog restart
#现在服务端收集客户端日志，并保存在/var/log各日志文件中，tail -f 查看
|
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
|
# tar -xzf nginx-1.4.7.tar.gz
# cd nginx-1.4.7
# ./configure --user=www --group=www --prefix=/usr/local/nginx \
--with-http_stub_status_module --with-http_ssl_module --with-http_gzip_static_module \
--with-pcre=
/root/pcre-8
.35 --with-http_realip_module --with-http_image_filter_module
#这个是测试，我是把pcre-8.35解压到root目录
# make
# make install
#以上是安装nginx的步骤，下面打补丁
# git clone https://github.com/splitice/nginx_syslog_patch
# patch -p1 < /root/nginx-1.4.7/nginx_syslog_patch/syslog-1.4.0.patch
patching
file
src
/core/ngx_cycle
.c
patching
file
src
/core/ngx_log
.c
patching
file
src
/core/ngx_log
.h
patching
file
src
/http/modules/ngx_http_log_module
.c
patching
file
src
/http/ngx_http_core_module
.c
Hunk
#2 succeeded at 4895 (offset 2 lines).
Hunk
#3 succeeded at 4913 (offset 2 lines).
Hunk
#4 succeeded at 4952 (offset 2 lines).
patching
file
src
/http/ngx_http_request
.c
Hunk
#1 succeeded at 517 (offset -14 lines).
Hunk
#2 succeeded at 798 (offset -23 lines).
Hunk
#3 succeeded at 2002 (offset -23 lines).
# ./configure --user=www --group=www --prefix=/usr/local/nginx \
--with-http_stub_status_module --with-http_ssl_module --with-http_gzip_static_module \
--with-pcre=
/root/pcre-8
.35 --with-http_realip_module --with-http_image_filter_module \
--add-module=
/root/nginx-1
.4.7
/nginx_syslog_patch/
# make
# make install
# /usr/local/nginx/sbin/nginx -V #查看编译的配置参数
nginx version: nginx
/1
.4.7
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-11) (GCC)
TLS SNI support enabled
configure arguments: --user=www --group=www --prefix=
/usr/local/nginx
\
--with-http_stub_status_module --with-http_ssl_module --with-http_gzip_static_module \
--with-pcre=
/root/pcre-8
.35 --with-http_realip_module --with-http_image_filter_module \
--add-module=
/root/nginx-1
.4.7
/nginx_syslog_patch/
# grep -v ^.*# /usr/local/nginx/conf/nginx.conf|sed '/^$/d' #nginx配置
worker_processes 1;
syslog local6 nginx;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application
/octet-stream
;
log_format main
'$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"'
;
sendfile on;
keepalive_timeout 65;
server {
listen 80;
server_name localhost;
index index.html;
root
/var/www
;
access_log syslog:notice|logs
/host1
.access.log main;
error_log syslog:notice|logs
/host1
.error.log;
error_page 500 502 503 504
/50x
.html;
location =
/50x
.html {
root html;
}
}
}
|