Syslog客户端、服务端配置、测试

需求：在两台机器上，通过rsyslog提供的日志转发功能，将其中一台机器(客户端）的日志转发到另一台（服务端），也就是需要一个日志服务器。

 

一、安装syslog软件包：

[root@SyslogVM]rpm -ivh rsyslog-7.4.7-16.el7.x86_64.rpm   #安装

[root@SyslogVM]# rpm -qa | grep syslog                               #查看是否安装

rsyslog-7.4.7-16.el7.x86_64

二、搭建Linux日志服务器（服务端 10.21.144.111，接收）： 服务端主要做的是配置监听端口，决定采用TCP还是UDP方式。本例采用UDP

1、编辑配置文件 /etc/sysconfig/rsyslog

修改配置文件中SYSLOGD_OPTIONS="-c 5" 添加“ -r选项”即可，目的可以让服务器能够接受客户端传来的数据

-r表示允许接收外来的消息，-x表示不解析DNS,

#-m 0表示时间戳标记间隔,如果指定只接受某个或多个ip过来的日志，例"-s 168.1.1.1:168.1.1.2"

[root@SyslogVM etc]# vim  /etc/sysconfig/rsyslog
# Options for rsyslogd
# Syslogd options are deprecated since rsyslog v3.
# If you want to use them, switch to compatibility mode 2 by "-c 2"
# See rsyslogd(8) for more details
SYSLOGD_OPTIONS="-r -c 5"

2、修改/etc/rsyslog.conf文件，指定传输方式、端口、日志存放位置

[root@SyslogVM etc]# vim /etc/rsyslog.conf

使用UDP接收方式:
$ModLoad imudp
$UDPServerRun 514

日志存放位置：客户端传来的日志记录在remote.log中
*.* /var/log/syslog/remote.log

3、重启syslog服务  

[root@SyslogVM etc]# service rsyslog restart

 

三、搭建syslog客户端10.21.144.110（发送）： 客户端主要做的是配置需要转储的日志，还有转储方式(TCP、UDP)，客户端/etc/rsyslog.conf配置如下：

1、在syslog配置文件中修改/etc/rsyslog.conf：

[root@zhang etc]#

# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html

# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

 

#### MODULES ####

# The imjournal module bellow is now used as a message source instead of imuxsock.

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)

$ModLoad imjournal # provides access to the systemd journal

#$ModLoad imklog # reads kernel messages (the same are read from journald)

#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception

$ModLoad imudp

$UDPServerRun 514

 

# Provides TCP syslog reception

#$ModLoad imtcp

#$InputTCPServerRun 514

 

*.*   @10.21.144.111  #第一个*表示所有的日志类别，10.21.144.111远端日志服务器地址,一个@表示UDP协议，TCP协议使用两个@

*.* /var/log/syslog/client.log  #客户端日志存储位置

 

#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files

$WorkDirectory /var/lib/rsyslog

 

# Use default timestamp format

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

 

# File syncing capability is disabled by default. This feature is usually not required,

# not useful and an extreme performance hit

#$ActionFileEnableSync on

 

# Include all config files in /etc/rsyslog.d/

$IncludeConfig /etc/rsyslog.d/*.conf

 

# Turn off message reception via local log socket;

# local messages are retrieved through imjournal now.

$OmitLocalLogging on

 

# File to store the position in the journal

$IMJournalStateFile imjournal.state

 

 

#### RULES ####

# Log all kernel messages to the console.

# Logging much else clutters up the screen.

kern.*                                                 /dev/console

 

# Log anything (except mail) of level info or higher.

# Don't log private authentication messages!

*.info;mail.none;authpriv.none;cron.none                /var/log/messages

 

# The authpriv file has restricted access.

authpriv.*                                              /var/log/secure

 

# Log all the mail messages in one place.

mail.*                                                  -/var/log/maillog

 

 

# Log cron stuff

cron.*                                                  /var/log/cron

 

# Everybody gets emergency messages

*.emerg                                                 :omusrmsg:*

 

# Save news errors of level crit and higher in a special file.

uucp,news.crit                                          /var/log/spooler

 

# Save boot messages also to boot.log

local7.*                                                /var/log/boot.log

 

 

# ### begin forwarding rule ###

# The statement between the begin ... end define a SINGLE forwarding

# rule. They belong together, do NOT split them. If you create multiple

# forwarding rules, duplicate the whole block!

# Remote Logging (we use TCP for reliable delivery)

#

# An on-disk queue is created for this action. If the remote host is

# down, messages are spooled to disk and sent when it is up again.

#$ActionQueueFileName fwdRule1 # unique name prefix for spool files

#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)

#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown

#$ActionQueueType LinkedList   # run asynchronously

#$ActionResumeRetryCount -1    # infinite retries if host is down

# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional

#*.* @@remote-host:514

# ### end of the forwarding rule ###

2、重启syslog客户端

[root@zhang etc]# service rsyslog restart

3、查看监听端口是否正常：

[root@zhang syslog]# netstat -anup | grep syslog
udp        0      0 0.0.0.0:514             0.0.0.0:*                           19607/rsyslogd
udp        0      0 0.0.0.0:34044           0.0.0.0:*                           19607/rsyslogd
udp6       0      0 :::514                  :::*                                19607/rsyslogd

 

注意：关闭客户端与服务端的防火墙   否则可能服务端收不到客户端的日志

1:查看防火墙状态
systemctl status firewalld
service  iptables status

2:暂时关闭防火墙
systemctl stop firewalld
service  iptables stop

3:永久关闭防火墙
systemctl disable firewalld
chkconfig iptables off

4:重启防火墙
systemctl enable firewalld
service iptables restart  

 

四、测试syslog日志服务器是否可用：

在客户端10.21.144.110上可以使用logger命令来写入一条系统日志，比如：
[root@zhang syslog]# logger 'hello world'

然后在日志服务器上10.21.144.111查看log master机器上的/var/log/syslog/remote.log文件，可以看到类似下面的内容：
[root@SyslogVM syslog]# cat /var/log/syslog/remote.log | grep 'hello world'| head -n 5
Feb 18 14:05:32 zhang root: hello world
Feb 18 14:09:28 zhang root: hello world
其中包括了日期，日志来源（机器名称），进程名和日志内容。