上一篇我们把日志服务器搭建和配置讲解完成，这节讲rsyslog客户端配置。因为系统默认已经安装rsyslo就不在复数了。只讲配置。
注意：本教程是Rsyslog v5.x版本讲解的，新版V8.x链接地址：点击跳转。
# rpm -qa | grep rsyslog //#查看系统默认已经安装软件包
# rpm -ql rsyslog ///显示rsyslog相关信息注：教程配置文件下载。
在rsyslog.conf 中配置，在文件末尾添加如下,全局远程提交路径：
全局变量配置文件：/etc/rsyslog.conf
局部变量配置文件：/etc/rsyslog.d/*.conf ,比如我们想监控tomcat，还想监控nginx的日志，如果把这些配置都放到全局变量里配置文件里，即不方便维护，也使全局配置文件臃肿，然后，就把tomcat配置写成一个独立文件tomcatlog.conf放到/etc/rsyslog.d/；在把nginx配置文件写成nginxlog.conf，然后每次重启rsyslog是就会加载/etc/rsyslog.d/下的tomcatlog、nginxlog配置文件了，不想监控时，直接删除对应的文件即可。（注意：全局配置文件里$IncludeConfig /etc/rsyslog.d/*.conf要开启，把$前#号删掉就开启），操作完配置文件，一定要重启rsyslog服务。
如果客户端所有日志都提交到一个服务器，可以把IP定义在全局变量里，反之则在相关脚本中定义。
@代表UDF方式传输，@@代表是TCP方式传输。
*.* 左边的*是设备，右边*是类型（正常、一般、紧急等），这个不要理解成系统里的文件名和后缀。
rsyslog模块里O开头是输出模块，比如把数据写到数据库；I开头是输入模块，比如把一个日志读到rsyslog里。
vi /etc/rsyslog.conf //编辑rsyslog全局文件
# rsyslog v5 configuration file # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html # If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html #### MODULES #### $ModLoad imuxsock #provides support for local system #logging (e.g. via logger command)#Unix套接字，包括系统日志socket $ModLoad imklog # provides kernel logging support(previously done by rklogd) #module(load"immark") # provides --MARK-- message capability # Provides UDP syslog reception # UDP传输，只在rsyslog作服务器时候使用 #$ModLoad imudp #$UDPServerRun 514 #Provides TCP syslog reception # TCP传输，只在rsyslog作服务器时候使用 #$ModLoad imtcp # tcp接收信息的端口 #$InputTCPServerRun 514 #### GLOBAL DIRECTIVES #### # Use default timestamp format #配置错误可能导致系统不生成日志 RSYSLOG_TraditionalFileFormat # File syncing capability is disabled by default. This feature is usually not required, # not useful and an extreme performance hit #$ActionFileEnableSync on # Include all config files in /etc/rsyslog.d/ #模块化配置文件存放，默认加载全部.conf后缀的文件 $IncludeConfig /etc/rsyslog.d/*.conf #### RULES #### # Log all kernel messages to the console. # Logging much else clutters up the screen. #kern.* /dev/console # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg :omusrmsg:* # Save news errors of level crit and higher in a special file. uucp,news.crit /var/log/spooler # Save boot messages also to boot.log local7.* /var/log/boot.log # ### begin forwarding rule ### # The statement between the begin ... end define a SINGLE forwarding # rule. They belong together, do NOT split them. If you create multiple # forwarding rules, duplicate the whole block! # Remote Logging (we use TCP for reliable delivery) # # An on-disk queue is created for this action. If the remote host is # down, messages are spooled to disk and sent when it is up again. #$WorkDirectory /var/lib/rsyslog # where to place spool files #$ActionQueueFileName fwdRule1 # unique name prefix for spool files #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown #$ActionQueueType LinkedList # run asynchronously #$ActionResumeRetryCount -1 # infinite retries if host is down # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional #*.* @@remote-host:514 # ### end of the forwarding rule ### #日志如非本地存储，需指定远程收集日志服务器IP:Port *.* @@192.168.1.251:514 //表示所有类型的日志都提交
重启日志服务，修改完配置文件一定要重启服务才能生效
# service rsyslog restart
测试：
一、查看rsyslog配置是否正确
#rsyslogd -N1 -f rsyslog.conf
显示配置成功
二、查看看能否产生日志
打开两个终端ssh窗口，可以通过观察系统中的Rsyslog日志，确定是否正常工作。
#cat /var/log/messages |grep rsyslog
或
#tail -f /var/log/messages |grep rsyslog
客户端手动产生日志
#logger -p local5.info test123
rsyslog做服务端接收配置说明：
开启接收远程信息：
edit /etc/sysconfig/rsyslog with option -r:
修改成：SYSLOGD_OPTIONS=”-m 0 -r”
默认开启UDP 514端口，请确保防火墙没有阻止
rsyslog配置文件说明：
在其它的节点的 Linux 上配置syslog日志功能，收集系统各方面日志主要包括以下日志内容
格式::
日志设备(类型).(连接符号)日志级别 日志处理方式(action)
日志设备(可以理解为日志类型):
———————————————————————-
auth –pam产生的日志
authpriv –ssh,ftp等登录信息的验证信息
cron –时间任务相关
kern –内核
lpr –打印
mail –邮件
mark(syslog)–rsyslog服务内部的信息,时间标识
news –新闻组
user –用户程序产生的相关信息
uucp –unix to unix copy, unix主机之间相关的通讯
local 1~7 –自定义的日志设备
日志级别:
———————————————————————-
debug –有调式信息的，日志信息最多
info –一般信息的日志，最常用
notice –最具有重要性的普通条件的信息
warning –警告级别
err –错误级别，阻止某个功能或者模块不能正常工作的信息
crit –严重级别，阻止整个系统或者整个软件不能正常工作的信息
alert –需要立刻修改的信息
emerg –内核崩溃等严重信息
none –什么都不记录
从上到下，级别从低到高，记录的信息越来越少
详细的可以查看手册: man 3 syslog
连接符号
———————————————————————-
.xxx: 表示大于等于xxx级别的信息
.=xxx：表示等于xxx级别的信息
.!xxx：表示在xxx之外的等级的信息
Actions
———————————————————————
模板能使用的路径变量：
msg the MSG part of the message (aka "the message" ;))
rawmsg the message exactly as it was received from the socket.
Should be useful for debugging.
HOSTNAME
hostname from the message
FROMHOST
hostname of the system the message was received from (in a
relay chain, this is the system immediately in front of us and
not necessarily the original sender)
syslogtag
TAG from the message
programname
the "static" part of the tag, as defined by BSD syslogd. For
example, when TAG is "named[12345]", programname is "named".
PRI PRI part of the message - undecoded (single value)
PRI-text
the PRI part of the message in a textual form (e.g.
"syslog.info")
IUT the monitorware InfoUnitType - used when talking to a
MonitorWare backend (also for phpLogCon)
syslogfacility
the facility from the message - in numerical form
syslogfacility-text
the facility from the message - in text form
syslogseverity severity from the message - in numerical form
syslogseverity-text severity from the message - in text form
timegenerated
timestamp when the message was RECEIVED. Always in high
resolution
timereported
timestamp from the message. Resolution depends on what was
provided in the message (in most cases, only seconds)
TIMESTAMP alias for timereported
PROTOCOL-VERSION
The contents of the PROTOCOL-VERSION field from IETF draft
draft-ietf-syslog-protocol
STRUCTURED-DATA
The contents of the STRUCTURED-DATA field from IETF draft
draft-ietf-syslog-protocol
APP-NAME
The contents of the APP-NAME field from IETF draft draft-ietf-syslog-protocol
PROCID The contents of the PROCID field from IETF draft draft-ietf-syslog-protocol
MSGID The contents of the MSGID field from IETF draft draft-ietf-syslog-protocol
$NOW The current date stamp in the format YYYY-MM-DD
$YEAR #年The current year (4-digit)
$MONTH #月 The current month (2-digit)
$DAY #日 The current day of the month (2-digit)
$HOUR #时 The current hour in military (24 hour) time (2-digit)
$MINUTE The current minute (2-digit)
使用样例：
%HOSTNAME% #主机名
%$YEAR%
%$MONTH%
%$DAY%
%$HOUR%
%timegenerated%
%syslogtag%
%property%
———————————————————————-
其他相关路径：
/etc/rc.d/init.d/rsyslog #开机启动项
/etc/sysconfig/rsyslog #接收远程信息配置
/etc/pki/rsyslog
/lib64/rsyslog #64位库
/var/lib/rsyslog
/var/spool/rsyslog
/var/log/rsyslog #日志文件夹
/var/lock/subsys/rsyslog
参考文章：
http://www.biglog.cn/tomcat-syslog/
http://my.oschina.net/0757/blog/198329?fromerr=wsJoMf7J