展厅设计说明,招聘seo网站推广,网站开发语言总结,网站上传到虚拟空间(一)Rsyslog简介ryslog 是一个快速处理收集系统日志的程序#xff0c;提供了高性能、安全功能和模块化设计。rsyslog 是syslog 的升级版#xff0c;它将多种来源输入输出转换结果到目的地。rsyslog是一个开源工具#xff0c;被广泛用于Linux系统以通过TCP/UDP协议转发或接收…(一)Rsyslog简介ryslog 是一个快速处理收集系统日志的程序提供了高性能、安全功能和模块化设计。rsyslog 是syslog 的升级版它将多种来源输入输出转换结果到目的地。rsyslog是一个开源工具被广泛用于Linux系统以通过TCP/UDP协议转发或接收日志消息。rsyslog守护进程可以被配置成两种环境一种是配置成日志收集服务器rsyslog进程可以从网络中收集其它主机上的日志数据这些主机会将日志配置为发送到另外的远程服务器。rsyslog的另外一个用法就是可以配置为客户端用来过滤和发送内部日志消息到本地文件夹(如/var/log)或一台可以路由到的远程rsyslog服务器上。logrotate是一个日志文件管理工具。用来把旧文件轮转、压缩、删除并且创建新的日志文件。我们可以根据日志文件的大小、天数等来转储便于对日志文件管理一般都是通过cron计划任务来完成的。序号IP地址类型备注1192.168.99.99Server端2192.168.99.98client端(二)rsyslog server服务端配置1rsyslog默认是安装的如果没有安装通过[rootlocalhost samba]# yum install rsyslog -y2修改/etc/rsyslog.conf配置文件启用udp和tcp模块 $ModLoad imudp $UDPServerRun 514 $ModLoad imtcp$InputTCPServerRun 514[rootlocalhost samba]# vim /etc/rsyslog.conf$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)$ModLoad imjournal # provides access to the systemd journal#####开启udp接收日志$ModLoad imudp$UDPServerRun 514$template RemoteHost,/data/syslog/%$YEAR%-%$MONTH%-%$DAY%/%FROMHOST-IP%.log*.* ?RemoteHost ~####开启tcp协议接受日志$ModLoad imtcp$InputTCPServerRun 514$WorkDirectory /var/lib/rsyslog$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat#######启用/etc/rsyslog.d/*.conf目录下所有以.conf结尾的配置文件$IncludeConfig /etc/rsyslog.d/*.conf$OmitLocalLogging on$IMJournalStateFile imjournal.state*.info;mail.none;authpriv.none;cron.none /var/log/messagesauthpriv.* /var/log/securemail.* -/var/log/maillogcron.* /var/log/cron*.emerg :omusrmsg:*uucp,news.crit /var/log/spoolerlocal7.* /var/log/boot.loglocal0.* /etc/keepalived/keepalived.log3,重启rsyslog服务[rootzabbix 2018-05-23]# systemctl restart rsyslog[rootzabbix 2018-05-23]# systemctl status rsyslog[rootlocalhost samba]# netstat -anp|grep 514tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 1445/rsyslogdtcp6 0 0 :::514 :::* LISTEN 1445/rsyslogdudp 0 0 0.0.0.0:514 0.0.0.0:* 1445/rsyslogdudp6 0 0 :::514 :::* 1445/rsyslogd(三)rsyslog客户端的配置1编辑rsylog客户端的配置文件[rootserver98 log]# grep -v ^$ /etc/rsyslog.conf | grep -v ^#$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)$ModLoad imjournal # provides access to the systemd journal$WorkDirectory /var/lib/rsyslog$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat$template myFormat,%timestamp% %fromhost-ip% %msg%\n #######自定义模板的相关信息$IncludeConfig /etc/rsyslog.d/*.conf$OmitLocalLogging on$IMJournalStateFile imjournal.state*.* 192.168.99.99:514 ########该声明告诉rsyslog守护进程将系统上各个设备的各种日志的所有消息路由到远程rsyslog服务器(192.168.99.99)的UDP端口514。是通过tcp传输一个是通过udp传输。*.info;mail.none;authpriv.none;cron.none /var/log/messagesauthpriv.* /var/log/securemail.* -/var/log/maillogcron.* /var/log/cron*.emerg :omusrmsg:*uucp,news.crit /var/log/spoolerlocal7.* /var/log/boot.loglocal0.* /etc/keepalived/keepalived.log2重启客户端rsyslog服务[rootserver98 log]# systemctl restart rsyslog[rootserver98 log]# systemctl status rsyslog● rsyslog.service - System Logging ServiceLoaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)Active: active (running) since 四 2018-05-24 16:57:04 CST; 4s agoMain PID: 44765 (rsyslogd)CGroup: /system.slice/rsyslog.service└─44765 /usr/sbin/rsyslogd -n5月 24 16:57:04 server98 systemd[1]: Starting System Logging Service...5月 24 16:57:04 server98 systemd[1]: Started System Logging Service.(四)查看客户端和服务端的日志是否正常生成。(1)查看服务端是否在/data/日期/ip.log正常生成。[rootzabbix 2018-05-24]# tail -f /data/2018-05-24/192.168.99.98.log2018-05-24T17:02:5208:00 server98 postfix/pickup[41198]: AAC764ACB03: uid0 from2018-05-24T17:02:5208:00 server98 postfix/cleanup[45967]: AAC764ACB03: message-id20180524090252.AAC764ACB03server98.localdomain2018-05-24T17:02:5208:00 server98 postfix/qmgr[2356]: AAC764ACB03: from, size851, nrcpt1 (queue active)2018-05-24T17:02:5208:00 server98 postfix/smtp[39596]: AAC764ACB03: to, relaynone, delay0, delays0/0/0/0, dsn5.4.4, statusbounced (Host or domain name not found. Name service error for nameaddress.somewhere typeAAAA: Host not found)2018-05-24T17:02:5208:00 server98 postfix/cleanup[45967]: AB6804ACB0B: message-id20180524090252.AB6804ACB0Bserver98.localdomain2018-05-24T17:02:5208:00 server98 postfix/bounce[45968]: AAC764ACB03: sender non-delivery notification: AB6804ACB0B2018-05-24T17:02:5208:00 server98 postfix/qmgr[2356]: AB6804ACB0B: from, size2811, nrcpt1 (queue active)2018-05-24T17:02:5208:00 server98 postfix/qmgr[2356]: AAC764ACB03: removed2018-05-24T17:02:5208:00 server98 postfix/smtp[39597]: AB6804ACB0B: to, relaynone, delay0, delays0/0/0/0, dsn5.4.4, statusbounced (Host or domain name not found. Name service error for namecompany.xy typeAAAA: Host not found)2018-05-24T17:02:5208:00 server98 postfix/qmgr[2356]: AB6804ACB0B: removed2018-05-24T17:14:3308:00 server98 root: hello world(2)在客户端生成日志是否日志同步都有[rootserver98 ~]# tail -f /var/log/messagesMay 24 17:11:40 server98 Keepalived_vrrp[49377]: VRRP_Script(chk_http_port) succeededMay 24 17:11:52 server98 smokeping[38532]: Alert someloss is active for Other.hefei.hefei-office2May 24 17:11:52 server98 smokeping[38532]: Alert someloss is active for Other.wuxi.wuxi-office2May 24 17:12:52 server98 smokeping[38532]: Alert someloss is active for Other.hefei.hefei-office2May 24 17:12:52 server98 smokeping[38532]: Alert someloss is active for Other.wuxi.wuxi-office2May 24 17:13:52 server98 smokeping[38532]: Alert someloss is active for Other.hefei.hefei-office2May 24 17:13:52 server98 smokeping[38532]: Alert someloss is active for Other.wuxi.wuxi-office2May 24 17:14:33 server98 root: hello world至此日志服务端和客户端日志同步完成。备注1Facility是syslog的模块: rsyslog通过facility概念来定义日志消息的来源以方便对日志进行分类。Facility:有0-23种设备可选在python的syslog库中有一部分缺失0 kernel messages1 user-level messages2 mail system3 system daemons4 security/authorization messages5 messages generated internally by syslogd6 line printer subsystem7 network news subsystem8 UUCP subsystem9 clock daemon10 security/authorization messages11 FTP daemon12 NTP subsystem13 log audit14 log alert15 clock daemon16-23 local0 - local7常用的有2Severity:日志等级0 Emergency1 Alert2 Critical3 Error4 Warning5 Notice6 Informational7 Debug重要的配置文件1rsyslog server服务端的配置[rootzabbix 2018-05-23]# grep -v ^$ /etc/rsyslog.conf | grep -v ^#$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)$ModLoad imjournal # provides access to the systemd journal$ModLoad imudp$UDPServerRun 514$template RemoteHost,/data/%$YEAR%-%$MONTH%-%$DAY%/%FROMHOST-IP%.log*.* ?RemoteHost ~$ModLoad imtcp$InputTCPServerRun 514$WorkDirectory /var/lib/rsyslog$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat$IncludeConfig /etc/rsyslog.d/*.conf$OmitLocalLogging on$IMJournalStateFile imjournal.state*.info;mail.none;authpriv.none;cron.none /var/log/messagesauthpriv.* /var/log/securemail.* -/var/log/maillogcron.* /var/log/cron*.emerg :omusrmsg:*uucp,news.crit /var/log/spoolerlocal7.* /var/log/boot.loglocal0.* /etc/keepalived/keepalived.log2rsyslog 客户端的配置[rootserver98 log]# grep -v ^$ /etc/rsyslog.conf | grep -v ^#$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)$ModLoad imjournal # provides access to the systemd journal$WorkDirectory /var/lib/rsyslog$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat$template myFormat,%timestamp% %fromhost-ip% %msg%\n$IncludeConfig /etc/rsyslog.d/*.conf$OmitLocalLogging on$IMJournalStateFile imjournal.state*.info;mail.none;authpriv.none;cron.none 192.168.99.99:514*.info;mail.none;authpriv.none;cron.none /var/log/messagesauthpriv.* /var/log/securemail.* -/var/log/maillogcron.* /var/log/cron*.emerg :omusrmsg:*uucp,news.crit /var/log/spoolerlocal7.* /var/log/boot.loglocal0.* /etc/keepalived/keepalived.log
