Note4rsyslog，logrotate，journalctl

Posted 2023-02-28 码农编程录

文章目录

• 1.rsyslog：rsyslogd一个进程 ，管理每个进程发来的log并往/var/log里写，syslog函数将log写给rsyslogd进程，rsyslogd -v
• 2.logrotate：logrotate /etc/logrotate.rsyslog（bb中重命名）
• • 2.2 rsyslog：通过rsyslog.conf采集内存中数据并保存
  • • log_rotate：执行第一行
    • rsyslog.logrotate：相当于/etc/logrotate.conf
    • rsyslog.conf
    • rsyslog_%.bbappend
• 2.logrotate：/etc/logrotate.conf = include /etc/logrotate.d
• • • logrotate-default
    • logrotate_%.bbappend
• 3.journalctl：内存中日志，因为是二进制无法查看，所以用journalctl命令查看

---

1.rsyslog：rsyslogd一个进程 ，管理每个进程发来的log并往/var/log里写，syslog函数将log写给rsyslogd进程，rsyslogd -v

ident将是一个标记，省略的话即打印出进程的名字如下。

grep -v "^#" /etc/rsyslog.conf | grep -v "^$"   #排除文件中以#开头和去除空行

# 如下在37客户端，/etc/rsyslog.conf中，将info级别及其以上级别（可改成crit等其他级别）的日志发送给target服务端
*.info action(type="omfwd" name="remoteLog" template="LogUtilFileFormat" target="10.75.159.146" port="514" protocol="udp"
           queue.type="LinkedList" action.resumeRetryCount="1" action.resumeInterval="60"
           queue.size="500" queue.workerthreadminimummessages="101" queue.discardseverity="0"
           queue.timeoutenqueue="0" queue.timeoutshutdown="10" queue.timeoutactioncompletion="100"
           action.reportSuspension="off" action.reportSuspensionContinuation="off")

$IncludeConfig /etc/rsyslog.d/*.conf

# 如下在146服务端，/etc/rsyslog.conf中打开如下配置，tcp打开tcp的配置
module(load="imudp")
input(type="imudp" port="514")
$IncludeConfig /etc/rsyslog.d/*.conf

# /etc/rsyslog.d/remote.conf 配置如下（修改完需重启rsyslog进程），sonic将如下直接写在rsyslog.conf：
:fromhost,isequal, "10.75.159.37"  /var/log/remote_37.log

2.logrotate：logrotate /etc/logrotate.rsyslog（bb中重命名）

# rsyslog.logrotate
     postrotate  #脚本只执行一次 开始
         /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
        # HUP/USR1/USR2（挂起信号，重新加载配置文件）
     endscript   #结束

logrotate是有两种方式做定时任务的，如果使用Crontab模式，则把 /etc/cron.daily/logrotate这个文件里检测/run/systemd/system目录的这3行注释掉就可以；然后停掉logrotate.timer（systemctl stop logrotate.timer）。

不换行输出

处理特殊字符

Feb  2 02:05:51.100144 bmc WARNING bmc#ipmid: sel_add_entry: SEL rollover
Feb  2 02:05:51.102943 bmc WARNING bmc#ipmid: SEL Entry, FRU: 1, Content: 00:00:02:FF:A9:DA:63:01:00:04:0F:00:6F:C2:19:FF
Feb  2 02:05:51.357353 bmc CRIT bmc#ipmid: SEL Entry: FRU: 1, Record: Standard (0x02), Time: 2023-02-02 02:05:51, Sensor: POST_ERROR (0x00), Event Data: (C219FF) System Firmware Progress, IPMI Post Code, Primary processor initialization Assertion

2.2 rsyslog：通过rsyslog.conf采集内存中数据并保存

log_rotate：执行第一行

#!/bin/sh
/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit $EXITVALUE

rsyslog.logrotate：相当于/etc/logrotate.conf

/var/log/fscd.log
/var/log/dhclient.log
/var/log/messages
/var/log/sensor-mon.log
/var/log/power-mon.log
/var/log/come-mon.log
/var/log/temp-mon.log

        rotate 9
        missingok
        notifempty
        size 20M
        delaycompress
        compress
        postrotate
            /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
        endscript

rsyslog.conf

$ModLoad imuxsock           # provides support for local system logging (e.g. via logger command)
$ModLoad imklog             # kernel logging (formerly provided by rklogd)
module(load="imfile")       # Provides support for tailing and categorizing existing log files
$ActionQueueType Direct         # Do not queue these, write immediately
global(workDirectory="/tmp")    # Remembers the last file position when syslog restarts and does not retransmit

# Set the default permissions
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PreserveFQDN on

# Use format recognized by log-util.
$template LogUtilFileFormat," %$YEAR% %TIMESTAMP% %pri-text% __OPENBMC_VERSION__: %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\\n"

# Store dhclient logs into dhclient.log,
# store everything else into /var/log/messages
if $programname == "dhclient" then /var/log/dhclient.log
else  
# limit size to 21M
$outchannel messagefile_channel, /var/log/messages, 22020096, /usr/local/fbpackages/rotate/log_rotate
*.*  :omfile:$messagefile_channel;LogUtilFileFormat

# Save boot messages also to boot.log
local7.*        /tmp/boot.log;LogUtilFileFormat

# Store come-mon logs into come-mon_rsyslog.log
if $programname == "come-mon" then 
$outchannel comemonfile_channel, /var/log/come-mon.log, 22020096, /usr/local/fbpackages/rotate/log_rotate
*.*  :omfile:$comemonfile_channel;LogUtilFileFormat

# Store power-mon logs into power-mon_rsyslog.log
if $programname == "power-mon" then 
$outchannel powermonfile_channel, /var/log/power-mon.log, 22020096, /usr/local/fbpackages/rotate/log_rotate
*.*  :omfile:$powermonfile_channel;LogUtilFileFormat

# Store sensor-mon logs into sensor-mon_rsyslog.log
if $programname == "sensor-mon" then 
$outchannel sensormonfile_channel, /var/log/sensor-mon.log, 22020096, /usr/local/fbpackages/rotate/log_rotate
*.*  :omfile:$sensormonfile_channel;LogUtilFileFormat

# Store temp-mon logs into temp-mon_rsyslog.log
if $programname == "temp-mon" then
$outchannel tempmonfile_channel, /var/log/temp-mon.log, 22020096, /usr/local/fbpackages/rotate/log_rotate
*.*  :omfile:$tempmonfile_channel;LogUtilFileFormat

#mTerm_server log (TBD)
# Send local3 log to the /var/log/messages
#input(type="imfile"
#  File="/var/log/mTerm_consol.log"
#  Tag="oob_mTerm_consol"
#  Severity="debug"
#  Facility="local3"
#  reopenOnTruncate="on"
#)

# 如下将info级别及其以上级别（可改成crit等其他级别）的日志发送给target服务端
*.info action(type="omfwd" name="remoteLog" template="LogUtilFileFormat" target="10.75.159.146" port="514" protocol="udp"
           queue.type="LinkedList" action.resumeRetryCount="1" action.resumeInterval="60"
           queue.size="500" queue.workerthreadminimummessages="101" queue.discardseverity="0"
           queue.timeoutenqueue="0" queue.timeoutshutdown="10" queue.timeoutactioncompletion="100"
           action.reportSuspension="off" action.reportSuspensionContinuation="off")

$IncludeConfig /etc/rsyslog.d/*.conf

rsyslog_%.bbappend

FILESEXTRAPATHS_prepend := "$THISDIR/files:"

SRC_URI += "file://rsyslog.conf \\
            file://log_rotate \\
            file://rsyslog.logrotate \\
"

MTERM_LOG_FILES ?= "mTerm_$MACHINE"

do_install_append() 
  dst="$D/usr/local/fbpackages/rotate"
  rsysconf="$D$sysconfdir/rsyslog.d"
  install -d $dst
  install -d $rsysconf
  install -m 755 $WORKDIR/log_rotate $dst/log_rotate

  install -m 644 $WORKDIR/rsyslog.logrotate $D$sysconfdir/logrotate.rsyslog
  install -m 644 $WORKDIR/rsyslog.conf $D$sysconfdir/rsyslog.conf
  sed -i "s/__OPENBMC_VERSION__/$OPENBMC_VERSION/g" $D$sysconfdir/rsyslog.conf


FILES_$PN += "/usr/local/fbpackages/rotate"

2.logrotate：/etc/logrotate.conf = include /etc/logrotate.d

root@bmc:/var/log# cat /lib/systemd/system/logrotate.service 
[Unit]
Description=Rotate log files
Documentation=man:logrotate(8) man:logrotate.conf(5)
ConditionACPower=true

[Service]
Type=oneshot
ExecStart=/usr/sbin/logrotate /etc/logrotate.conf
Nice=19
ioschedulingClass=best-effort
IOSchedulingPriority=7

root@bmc:/var/log# cat /lib/systemd/system/logrotate.timer   
[Unit]
Description=Daily rotation of log files
Documentation=man:logrotate(8) man:logrotate.conf(5)

[Timer]
OnCalendar=daily
AccuracySec=12h
Persistent=true

[Install]
WantedBy=timers.target

logrotate-default

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

logrotate_%.bbappend

FILESEXTRAPATHS_append := "$THISDIR/$PN:"

SRC_URI += " \\
            file://logrotate-3.9.1/examples/logrotate-default \\
           "

# We need to rotate every hour or could quickly run out of RAM.
LOGROTATE_SYSTEMD_TIMER_BASIS = "hourly"
LOGROTATE_SYSTEMD_TIMER_ACCURACY = "30m"

do_install_append() 
    install -p -m 644 $WORKDIR/logrotate-3.9.1/examples/logrotate-default $D$sysconfdir/logrotate.conf

    if $@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d); then
        # XXX For now we build Yocto with systemd enabled and sysvinit
        # compat to allow remaining sysvinit scripts to continue working. 
        # With both systemd & sysvinit compat on, the logrotate recipe gets
        # it wrong and installs both the crontab entry and systemd timer. 
        # When sysvinit compat is removed then this can go away.
        rm -f $D$sysconfdir/cron.daily/logrotate
    fi

3.journalctl：内存中日志，因为是二进制无法查看，所以用journalctl命令查看