Rsyslog

Posted 2021-09-27 芒果牛奶

开放snmp协议端口

信息等级：
1 info  2 notice  3 warning(warn)  4 err(error)  5 crit  6 alert  7 emerg(panic)      越到后面，越严重
两个特殊等级，debug（错误检测等级）与 none （不需要登录等级），需要做错误检测或者忽略掉某些服务信息时使用

“.” 代表比符号后面更高的等级（含该等级)都被记录。如：mail.info 代表只要是mail的信息，而且改信息等级高于info（含info），都会被记录下来。

“.=“ 代表所需要的等级就是后面接的等级，其它不要

“.!” 代表不等于，即除该等级外的其他等级都记录

syslog的日志文件只要被编辑过，就无法记录，需要重新启动rsyslog服务

/etc/logrotate.conf 针对文件进行轮替操作

agent  
/etc/rsyslog.conf
<code>
$MaxMessageSize 128k
$ModLoad imuxsock
$ModLoad imklog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$ModLoad imudp
$UDPServerRun 514

$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0

$WorkDirectory /var/lib/rsyslog # where to place spool files
$ActionQueueFileName fwdRule1 # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
$ActionQueueType LinkedList # run asynchronously
$ActionResumeRetryCount -1 # infinite retries if host is down

:msg,contains,"GET /daemon.php?tableid" ~

*.* @@10.1.100.11
</code>


log server

/etc/rsyslog.conf
<code>
$MaxMessageSize 128k
$ModLoad imuxsock.so
$ModLoad imklog.so
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0

$ModLoad imtcp
$InputTCPServerRun 514


:msg,contains,"GET /daemon.php?tableid" ~
:rawmsg,contains,"ASKMQ-WORKER 29" ~

# Standard System Services
$template DYNmessages,"/var/log/LOGS/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/messages"
$template DYNsecure,"/var/log/LOGS/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/secure"
$template DYNmaillog,"/var/log/LOGS/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/maillog"
$template DYNcron,"/var/log/LOGS/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/cron"
$template DYNspooler,"/var/log/LOGS/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/spooler"
$template DYNboot,"/var/log/LOGS/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/boot.log"
$template DYNiptables,"/var/log/LOGS/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/iptables.log"
$template DYNaudit,"/var/log/LOGS/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/audit.log"
$template DYNapache-access,"/var/log/LOGS/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/apache-access.log"
$template DYNapache-error,"/var/log/LOGS/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/apache-error.log"
$template DYNphp,"/var/log/LOGS/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/php.log"
$template DYNredis,"/var/log/LOGS/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/redis.log"
$template DYNnodejs,"/var/log/LOGS/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/nodejs.log"


if $programname == \'apache-access\' then ?DYNapache-access
&~
if $programname == \'apache-error\' then ?DYNapache-error
&~
if $programname == \'audispd\' then ?DYNaudit
&~
if $programname == \'php\' then ?DYNphp
&~
if $programname == \'redis\' then ?DYNredis
&~
if $programname == \'NodeJS\' then ?DYNnodejs
&~
if $msg contains \'iptables:\' then ?DYNiptables
&~


if $syslogseverity <= \'6\' and ( $syslogfacility-text != \'mail\' and $syslogfacility-text != \'authpriv\' and $syslogfacility-text != \'cron\') then ?DYNmessages

if $syslogfacility-text == \'authpriv\' then ?DYNsecure

if $syslogfacility-text == \'mail\' then -?DYNmaillog

if $syslogfacility-text == \'cron\' then ?DYNcron

if ( $syslogfacility-text == \'uucp\' or $syslogfacility-text == \'news\' ) and $syslogseverity-text == \'crit\' then ?DYNspooler

if $syslogfacility-text == \'local7\' then ?DYNboot
</code>