syslog配置

Posted 2021-11-28 xue0123

syslog配置如下：

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
*.info;mail.none;authpriv.none;cron.none                /var/log/
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log
######### GLOBAL DIRECTIVES ####
$template IpTemplate,"/var/log/mylog/%FROMHOST-IP%/%$YEAR%-%$MONTH%-%$DAY%.log"
*.*  ?IpTemplate
& ~

syslog日志保存位置：

　　/var/log/mylog/%FROMHOST-IP%/%$YEAR%-%$MONTH%-%$DAY%.log

/var/log/mylog/192.168.187.237/2019-05-09.log