rsyslogd_Syslog

$ rsyslogd -version rsyslogd 5.8.10, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes Runtime Instrumentation (slow code): No See http://www.rsyslog.com for more information.

# rsyslog v5 configuration file # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html # If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html #### MODULES #### # 模块放在开头加载 $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) # 可以用来调试，稍后有例子 $ModLoad imklog # provides kernel logging support (previously done by rklogd) #$ModLoad immark # provides –MARK– message capability # Provides UDP syslog reception #$ModLoad imudp #$UDPServerRun 514 # Provides TCP syslog reception # TCP server，接收端需要加载这个模块，发送端不需要 #$ModLoad imtcp #$InputTCPServerRun 514 #### GLOBAL DIRECTIVES #### # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # 消息格式 # File syncing capability is disabled by default. This feature is usually not required, # not useful and an extreme performance hit #$ActionFileEnableSync on #### RULES #### # 用来指定哪种类型的，哪种级别的log，发送给谁处理 # Log all kernel messages to the console. # Logging much else clutters up the screen. # kern.* /dev/console # Log anything (except mail) of level info or higher. # Don’t log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* -/var/log/maillog # ‘-‘ 表示异步 # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * # Save news errors of level crit and higher in a special file. uucp,news.crit /var/log/spooler # Save boot messages also to boot.log local7.* /var/log/boot.log # local开头的是自定义的日志类型 # ### begin forwarding rule ### # The statement between the begin … end define a SINGLE forwarding # rule. They belong together, do NOT split them. If you create multiple # forwarding rules, duplicate the whole block! # Remote Logging (we use TCP for reliable delivery) # # An on-disk queue is created for this action. If the remote host is # down, messages are spooled to disk and sent when it is up again. #$WorkDirectory /var/lib/rsyslog # where to place spool files #$ActionQueueFileName fwdRule1 # unique name prefix for spool files #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown #$ActionQueueType LinkedList # run asynchronously #$ActionResumeRetryCount -1 # infinite retries if host is down # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional #*.* @@remote-host:514 # ### end of the forwarding rule ### # Finally include all config files in /etc/rsyslog.d. This allows overrides # of the default configuration above. $IncludeConfig /etc/rsyslog.d/*.conf # 这里会自动加载自定义的*.conf配置文件，可以覆盖默认参数

$ModLoad imfile # Load the imfile input module

$InputFileName /path/to/file # 待监控的文件路径 $InputFileTag tag # 文件唯一标识tag，最好保持唯一，用于接收端区分原始log文件，可以包含特殊字符，如”:”、”,”等 $InputFileStateFile /path/to/state/file # 【重要】需要保证发送端唯一，记录读取到哪儿，状态文件保存在$WorkDirectory，默认为 /var/lib/rsyslog # 如果某个要监控的文件名变化了，一定要重新设置该值 $InputFileFacility facility # log类型，默认local0， local开头的表示自定义类型 $InputFileSeverity severity # log级别：info，warning，默认notice $InputRunFileMonitor # 启动监控当前的文件，如果忘记这行，则啥事也不会发生 $InputFilePollInterval seconds # 全局设置，默认轮询是10s $InputFilePersistStateInterval lines # 每多少行更新state文件状态 $InputFileReadMode mode # 官网竟然没这个解释，不过也没用到。。。 $InputFileMaxLinesAtOnce number # 默认10240，如果在发送端，需要同时监控多个文件，会处理完当前文件特定行后，切换到下一个文件，避免一个文件一直占用处理，导致收集别的文件不及时。 $InputFileBindRuleset ruleset # 属于较高级的设置，可以把这个listener绑定到特点的规则(http://www.rsyslog.com/doc/v5-stable/concepts/multi_ruleset.html)

# For product, total 19 files. $InputFileName /Data/logs/product/cache-Statistic.log $InputFileTag product,cache-Statistic $InputFileSeverity info $InputFileStateFile state_product_cache-Statistic $InputFilePersistStateInterval 25000 $InputFileFacility local5 $InputRunFileMonitor

# Log cron stuff cron.* /var/log/cron # 记录info到本地messages文件，.none 结尾表示排除掉这些文件类型。 *.info;mail.none;authpriv.none;cron.none /var/log/messages # 所有为local5的任意级别日志发送到远端514 local5.* @@192.168.56.10:514

auth #pam产生的日志，认证日志 authpriv #ssh,ftp等登录信息的验证信息，认证授权认证 cron #时间任务相关 kern #内核 lpr #打印 mail #邮件 mark(syslog) #rsyslog服务内部的信息,时间标识 news #新闻组 user #用户程序产生的相关信息 uucp #unix to unix copy, unix主机之间相关的通讯 local 1~7 #自定义的日志设备

debug #有调式信息的，日志信息最多 info #一般信息的日志，最常用 notice #最具有重要性的普通条件的信息 warning, warn #警告级别 err, error #错误级别，阻止某个功能或者模块不能正常工作的信息 crit #严重级别，阻止整个系统或者整个软件不能正常工作的信息 alert #需要立刻修改的信息 emerg, panic #内核崩溃等严重信息

$template <name>,<内容>,<可选项> $template MyTemplateName,”7Text %property% some more textn”,<options>

<接收内容的时间> <发送者的hostname> <$InputFileTag> <原始消息%msg%> Dec 18 20:39:27 jumper-172-31-56-18 karltestdemoTag blala… dummy msg

$template CleanMsgFormat,”%msg%n”

%msg% %syslogfacility% %HOSTNAME% %syslogpriority% %timereported:::date-mysql% %timegenerated:::date-mysql% %iut% ‘%syslogtag%’

# For product $template productFileFormat,”/Data/logs/product/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log” if $syslogtag startswith ‘product’ then ?productFileFormat;CleanMsgFormat & ~

& ~

$MaxMessageSize 32k # Provides TCP syslog reception #$ModLoad imtcp #$InputTCPServerRun 514

# 修改前 *.info;mail.none;authpriv.none;cron.none /var/log/messages # Fix后 *.info;mail.none;authpriv.none;cron.none;local5.none;local6.none /var/log/messages

if $syslogtag startswith ‘product’ then ?productFileFormat;CleanMsgFormat & ~ # 新版本v6之后，变为： # rsyslogd: warning: ~ action is deprecated, consider using the ‘stop’ statement instead [try http://www.rsyslog.com/e/2307 ] if $syslogtag startswith ‘product’ then ?productFileFormat;CleanMsgFormat stop

# For erp_wms $template erp_wms_FileFormat,”/Data/logs/erp/wms/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log” if $syslogtag startswith ‘erp_wms’ then ?erp_wms_FileFormat;CleanMsgFormat & ~ # For erp_wms3 $template erp_wms3_FileFormat,”/Data/logs/erp/wms3/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log” if $syslogtag startswith ‘erp_wms3’ then ?erp_wms3_FileFormat;CleanMsgFormat & ~

# 这里注意下面的tag的顺序， 一定要让长的tag（erp_wms3）保持在上面，因为他们有共同的前缀(erp_wms) # For erp_wms3 $template erp_wms3_FileFormat,”/Data/logs/erp/wms3/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log” if $syslogtag startswith ‘erp_wms3’ then ?erp_wms3_FileFormat;CleanMsgFormat & ~ # For erp_wms $template erp_wms_FileFormat,”/Data/logs/erp/wms/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log” if $syslogtag startswith ‘erp_wms’ then ?erp_wms_FileFormat;CleanMsgFormat & ~

# 忽略旧的5.8.6的语法 template (name=”ForwardFormat” type=”string” string=”<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%”)

$InputFileName /Data/logs/mqorder/order-mq-aws/database-stat.log $InputFileTag erp_mqorder-order-mq-aws,database-stat # 长度39 … $InputFileName /Data/logs/mqorder/order-mq-aws/database-timeout.log $InputFileTag erp_mqorder-order-mq-aws,database-timeout # 长度42 …

# ### begin forwarding rule ### $template LongTagForwardFormat,”<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%” $WorkDirectory /var/lib/rsyslog # where to place spool files $ActionQueueFileName karlzhou_fwdRule # unique name prefix for spool files $ActionQueueMaxDiskSpace 5g # 5gb space limit (use as much as possible) $ActionQueueSaveOnShutdown on # save messages to disk on shutdown $ActionQueueType LinkedList # run asynchronously $ActionResumeRetryCount -1 # infinite retries if host is down local5.* @@rsyslog.karlzhou.org:514;LongTagForwardFormat # ### end of the forwarding rule ###

/* hardcoded standard templates (used for defaults) */ static uchar template_DebugFormat[] = “”Debug line with all properties:nFROMHOST: ‘%FROMHOST%’, fromhost-ip: ‘%fromhost-ip%’, HOSTNAME: ‘%HOSTNAME%’, PRI: %PRI%,nsyslogtag ‘%syslogtag%’, programname: ‘%programname%’, APP-NAME: ‘%APP-NAME%’, PROCID: ‘%PROCID%’, MSGID: ‘%MSGID%’,nTIMESTAMP: ‘%TIMESTAMP%’, STRUCTURED-DATA: ‘%STRUCTURED-DATA%’,nmsg: ‘%msg%’nescaped msg: ‘%msg:::drop-cc%’ninputname: %inputname% rawmsg: ‘%rawmsg%’nn””; static uchar template_SyslogProtocol23Format[] = “”<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%n””; static uchar template_TraditionalFileFormat[] = “=RSYSLOG_TraditionalFileFormat”; static uchar template_FileFormat[] = “=RSYSLOG_FileFormat”; static uchar template_ForwardFormat[] = “=RSYSLOG_ForwardFormat”; static uchar template_TraditionalForwardFormat[] = “=RSYSLOG_TraditionalForwardFormat”; static uchar template_WallFmt[] = “”rn7Message from syslogd@%HOSTNAME% at %timegenerated% …rn %syslogtag%%msg%nr””; static uchar template_StdUsrMsgFmt[] = “” %syslogtag%%msg%nr””; static uchar template_StdDBFmt[] = “”insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values (‘%msg%’, %syslogfacility%, ‘%HOSTNAME%’, %syslogpriority%, ‘%timereported:::date-mysql%’, ‘%timegenerated:::date-mysql%’, %iut%, ‘%syslogtag%’)”,SQL”; static uchar template_StdPgSQLFmt[] = “”insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values (‘%msg%’, %syslogfacility%, ‘%HOSTNAME%’, %syslogpriority%, ‘%timereported:::date-pgsql%’, ‘%timegenerated:::date-pgsql%’, %iut%, ‘%syslogtag%’)”,STDSQL”; static uchar template_spoofadr[] = “”%fromhost-ip%””; /* end templates */

/* smfwd.c * This is a strgen module for the traditional (network) forwarding format. * * Format generated: * “<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%” * * NOTE: read comments in module-template.h to understand how this file * works! * * File begun on 2010-06-01 by RGerhards *

# tree -I “*gz|*log” /Data/logs/ /Data/logs/ ├── gateway │ ├── 172.31.70.18 │ │ └── archived │ ├── 172.31.70.19 │ │ └── archived │ ├── 172.31.70.195 │ │ └── archived │ ├── 172.31.70.197 │ │ └── archived │ ├── 172.31.70.198 │ │ └── archived │ └── 172.31.70.20 │ └── archived ├── product │ ├── 172.31.70.118 │ │ └── archived │ ├── 172.31.70.119 │ │ └── archived │ ├── 172.31.70.23 │ │ └── archived │ └── 172.31.70.24 │ └── archived … # du -sh /Data/logs 271G /Data/logs