Rsyslog使用
1.Rsyslog介绍
Rsyslog is Rocket-fast System for Log processing.Rsyslog是CentOS6系列默认的日志处理软件。Rsyslog基于模块化设计，提供高性能，安全的日志处理系统。Rsyslog是多线程的，支持TCP,UDP,TLS,RELP.Rsyslog实际上syslog的一个增强版本。
2.安装Rsyslog
CentOS下默认已经安装了rsyslog
查看rsyslog运行状态
$service rsyslog status
rsyslogd (pid 7542) is running...
$ ps -ef|grep rsyslog|grep -v grep
root 1014 1 0 2014 ? 00:15:09 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
这里-c 5 是在/etc/sysconfig/rsyslog中定义的
$ cat /etc/sysconfig/rsyslog # Options for rsyslogd # Syslogd options are deprecated since rsyslog v3. # If you want to use them, switch to compatibility mode 2 by "-c 2" # See rsyslogd(8) for more details SYSLOGD_OPTIONS="-c 5"
3.配置rsyslog
rsyslog的配置文件/etc/rsyslog.conf
# rsyslog v5 configuration file # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html # If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html #### MODULES #### $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imklog # provides kernel logging support (previously done by rklogd) #$ModLoad immark # provides --MARK-- message capability # Provides UDP syslog reception #$ModLoad imudp #$UDPServerRun 514 # Provides TCP syslog reception #$ModLoad imtcp #$InputTCPServerRun 514 #### GLOBAL DIRECTIVES #### # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # File syncing capability is disabled by default. This feature is usually not required, # not useful and an extreme performance hit #$ActionFileEnableSync on # Include all config files in /etc/rsyslog.d/ $IncludeConfig /etc/rsyslog.d/*.conf #### RULES #### # Log all kernel messages to the console. # Logging much else clutters up the screen. #kern.* /dev/console # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* -/var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * # Save news errors of level crit and higher in a special file. uucp,news.crit /var/log/spooler # Save boot messages also to boot.log local7.* /var/log/boot.log # ### begin forwarding rule ### # The statement between the begin ... end define a SINGLE forwarding # rule. They belong together, do NOT split them. If you create multiple # forwarding rules, duplicate the whole block! # Remote Logging (we use TCP for reliable delivery) # # An on-disk queue is created for this action. If the remote host is # down, messages are spooled to disk and sent when it is up again. #$WorkDirectory /var/lib/rsyslog # where to place spool files #$ActionQueueFileName fwdRule1 # unique name prefix for spool files #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown #$ActionQueueType LinkedList # run asynchronously #$ActionResumeRetryCount -1 # infinite retries if host is down # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional #*.* @@remote-host:514 # ### end of the forwarding rule ###
$ cat /etc/rsyslog.conf|grep -v -E "^#|^$" $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imklog # provides kernel logging support (previously done by rklogd) $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $IncludeConfig /etc/rsyslog.d/*.conf *.info;mail.none;authpriv.none;cron.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron *.emerg * uucp,news.crit /var/log/spooler local7.* /var/log/boot.log
配置格式如下：
日志类型.日志级别 日志处理方式
| 日志类型 | 说明 |
| auth | pam模块产生的日志 |
| authpriv | ssh,sftp等的登录验证信息 |
| cron |
定时任务相关日志 |
| kernel |
内核相关日志 |
| lpr |
打印日志 |
| mail |
邮件相关日志 |
| news |
新闻组 |
| user |
用户程序产生的日志 |
| local 1-7 |
自定义的日志设备 |
| 日志级别 | 说明 |
级别值 |
| debug |
调试信息 | 7 |
| info | 一般信息 | |
| notice | 普通信息 |
|
| warning | 警告信息 | 4 |
| err | 错误信息 | |
| crit |
严重信息 |
|
| alert | 告警信息 | |
| emerg |
紧急信息 | |
| none |
| 连接符合 | 说明 |
| .xxx |
表示大于或等于xxx级别的信息 |
| .=xxx |
表示等于xxx级别的信息 |
| .!xxx |
除了xxx级别的信息 |
日志处理方式
# 记录到普通文件或设备文件 *.* /var/log/file.log # 绝对路径 *.* /dev/pts/0 # 测试: # logger 命令用于产生日志 logger -p local3.info 'KadeFor is testing the rsyslog and logger' # 转发到远程 *.* @192.168.0.1 # 使用UDP协议转发到192.168.0.1的514(默认)端口 *.* @@192.168.0.1:10514 # 使用TCP协议转发到192.168.0.1的10514(默认)端口 # 发送给用户(需要在线才能收到) *.* root *.* root,kadefor,up01 # 使用,号分隔多个用户 *.* * # *号表示所有在线用户 # 忽略,丢弃 local3.* ~ # 忽略所有local3类型的所有级别的日志 # 执行脚本 local3.* ^/tmp/a.sh # ^号后跟可执行脚本或程序的绝对路径 # 日志内容可以作为脚本的第一个参数. # 可用来触发报警
日志的记录有先后顺序
# Save boot messages also to boot.log local7.* /var/log/boot.log local3.* /var/log/local3.log
添加一行，然后执行service rsyslogd restart
然后执行
$ logger -p local3.info 'KadeFor is testing the rsyslog and logger'
在查看日志
$ sudo tail -f /var/log/local3.log
Feb 25 16:28:06 xxxx xxx: KadeFor is testing the rsyslog and logger
# 过滤日志, 由:号开头 :msg, contains, "error" /var/log/error.log :msg, contains, "error" ~ # 忽略包含error的日志 :msg, contains, "user nagios" ~ :msg, contains, "user kadefor" ~ :msg, contains, "module-alsa-sink.c: ALSA woke us up to write new data to the device, but there was actually nothing to write" ~ local3.* ~ # PS. & ~ # 忽略所有的日志
$template myFormat,"%rawmsg%n" $ActionFileDefaultTemplate myFormat #如果不要$ActionFileDefaultTemplate myFormat这一行, 就需要像这样来使用模板: #在日志文件后添加模板名, 并用;号分隔 $template myFormat,"%rawmsg%n" # The authpriv file has restricted access. authpriv.* /var/log/secure;myFormat # Log all the mail messages in one place. mail.* /var/log/maillog;myFormat # Log cron stuff cron.* /var/log/cron;myFormat # Everybody gets emergency messages *.emerg * # Save news errors of level crit and higher in a special file. uucp,news.crit /var/log/spooler;myFormat # Save boot messages also to boot.log local7.* /var/log/boot.log;myFormat
# 只要在rsyslog.conf中加入 *.* @192.168.0.10 *.* @192.168.0.10:10514 # 带端口号 *.* @@192.168.0.10 # TCP 使用一个@表示UDP，两个@@表示TCP
配置远程发送接收syslog日志
案例1：
客户端：
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional *.* @@10.10.41.17:514 # ### end of the forwarding rule ###
这里设置将所有的日志都通过TCP方式发送到远程的rsyslog服务器
然后执行
service rsyslog restart
服务端：
# Provides UDP syslog reception $ModLoad imudp $UDPServerRun 514 # Provides TCP syslog reception $ModLoad imtcp $InputTCPServerRun 514
然后执行
service rsyslog restart
现在客户端的rsyslog日志就可以直接发送一份到服务端
案例2：
客户端：
:rawmsg,contains,"sdns_log" @@10.10.41.17 :rawmsg,contains,"sdns_log" ~
前面讲过rsyslog的日志记录是有先后顺序的，这里将包含sdns_log的日志先发送到服务端，然后本地丢弃
重新启动rsyslog
服务端：
# Provides TCP syslog reception $ModLoad imtcp $InputTCPServerRun 514 $template logformat,"%TIMESTAMP:::date-mysql% %FROMHOST-IP%%msg%n" $template DynFile,"/var/log/tlog%$year%%$month%%$day%.log" :rawmsg,contains,"sdns_log" ?DynFile;logformat :rawmsg,contians,"sdns_log" ~
然后执行
service rsyslog restart
客户端测试：
$ logger -p user.info "sdns_log 34334"
查看服务端日志
$ sudo tail -f /var/log/tlog20150227.log
20150227113413 10.10.41.20 sdns_log 34334n
把不同服务器发送过来的日志存放到不同的文件
:fromhost-ip, isequal, "192.168.0.160" /var/log/host160.log :FROMHOST-IP, isequal, "192.168.0.161" /var/log/host161.log :FROMHOST-IP, startswith, "192.168.1." /var/log/network1.log :FROMHOST-IP, startswith, "192.168.2." /var/log/network2.log
案例3
自定义修改ssh的日志记录
修改ssh的配置文件/etc/ssh/sshd_config
SyslogFacility local5
这里将ssh的日志类型设置为local5，默认是AUTHPRIV
然后重新加载sshd
修改/etc/rsyslog.conf
添加
local5.* /var/log/sshd.log
将local5类型的日志记录到/var/log/sshd.log这个文件
然后重新启动rsyslog
查看日志
案例4
将mail日志保存到远程服务器的/var/log/newmail.log文件
参考文档：
http://www.rsyslog.com/
http://www.rsyslog.com/doc/v5-stable/
http://w.gdu.me/wiki/Linux/rsyslog_logrotate.html