syslog-ng安装和使用

概述

syslog-ng常用于接收交换机、LINUX SERVER等程序发出的log信息。

安装

yum install syslog-ng
本文安装的是syslog-ng-3.0.5

配置

/etc/syslog-ng/syslog-ng.conf

// 在最后加上：
#aliswich syslog
#定义一个source，表示哪里是log的源,下面的为不限IP，接收 514 端口报文。
source s_remote {
            tcp(ip( 0.0 . 0.0 ) port( 514 ));
            udp(ip( 0.0 . 0.0 ) port( 514 ));
};

# 定义一个存放log的目的位置
destination d_networkdevice { file( "/var/log/test_syslog.log" owner( "root" ) group( "root" ) perm( 0640 ) dir_perm( 0750 ) create_dirs(yes)); };
# 多个设备指定同一个server时，日志最好按IP分开存放。
destination d_separatedbyhosts {
       file( "/var/log/syslog-ng/$HOST/$MONTH$DAY.log" owner( "root" ) group( "root" ) perm( 0640 ) dir_perm( 0750 ) create_dirs(yes));};

# 也可以定义显示的内容
 destination d_separatedbyhosts {
       file( "/var/log/syslog-ng/$HOST/$MONTH$DAY.log" template("$FACILITY $LEVEL $PRIORITY $DATE $HOST $PROGRAM $MSGHDR$M
SG\n ") owner(" root ") group(" root") perm( 0640 ) dir_perm( 0750 ) create_dirs(yes));
};
#一个log存储规则的定义，还可以定义filter
log { source(s_remote); destination(d_networkdevice); };

重启syslog-ng

service syslog-ng restart

附录

变量名

#
#    Name               Description
#    ----------------  ----------------------------------------------
#    DATE               Date of the transaction.
#    DAY                The day of month the message was sent.
#    FACILITY           The name of the facility, the message is tagged 
#                       as coming from.
#    FULLDATE           Long form of the date of the transaction.
#    FULLHOST           Full hostname of the system that sent the log.
#    HOST               The name of the source host where the message 
#                       is originated from. If the message traverses 
#                       several hosts, and chain_hostnames() is on, 
#                       the first one is used.
#    HOUR               The hour of day the message was sent.
#    ISODATE            Date in ISO format.
#    MIN                The minute the message was sent.
#    MONTH              The month the message was sent.
#    MSG or MESSAGE     Message contents. 
#    PRIORITY or LEVEL  The priority of the message. 
#    PROGRAM            The name of the program the message was sent by.
#    SEC                The second the message was sent.
#    TAG                The priority and facility encoded as a 2 digit 
#                       hexadecimal number.
#    TZ                  The time zone or name or abbreviation. e.g. 'PDT'
#    TZOFFSET           The time-zone as hour offset from GMT. e.g. 
#                       '-0700'
#    WEEKDAY            The 3-letter name of the day of week the 
#                       message was sent, e.g. 'Thu'.
#    YEAR               The year the message was sent. Time expansion 
#                       macros can either use the time specified in 
#                       the log message, e.g. the time the log message 
#                       is sent, or the time the message was received 
#                       by the log server. This is controlled by the 
#                       use_time_recvd() option.#
#    Name               Description
#    ----------------  ----------------------------------------------
#    DATE               Date of the transaction.
#    DAY                The day of month the message was sent.
#    FACILITY           The name of the facility, the message is tagged 
#                       as coming from.
#    FULLDATE           Long form of the date of the transaction.
#    FULLHOST           Full hostname of the system that sent the log.
#    HOST               The name of the source host where the message 
#                       is originated from. If the message traverses 
#                       several hosts, and chain_hostnames() is on, 
#                       the first one is used.
#    HOUR               The hour of day the message was sent.
#    ISODATE            Date in ISO format.
#    MIN                The minute the message was sent.
#    MONTH              The month the message was sent.
#    MSG or MESSAGE     Message contents. 
#    PRIORITY or LEVEL  The priority of the message. 
#    PROGRAM            The name of the program the message was sent by.
#    SEC                The second the message was sent.
#    TAG                The priority and facility encoded as a 2 digit 
#                       hexadecimal number.
#    TZ                  The time zone or name or abbreviation. e.g. 'PDT'
#    TZOFFSET           The time-zone as hour offset from GMT. e.g. 
#                       '-0700'
#    WEEKDAY            The 3-letter name of the day of week the 
#                       message was sent, e.g. 'Thu'.
#    YEAR               The year the message was sent. Time expansion 
#                       macros can either use the time specified in 
#                       the log message, e.g. the time the log message 
#                       is sent, or the time the message was received 
#                       by the log server. This is controlled by the 
#                       use_time_recvd() option.