主页 / server / 问题 / 406522
Accepted
coding_hero
Asked: 2012-07-11 11:18:48 +0800 CST

从 syslog.conf 移动到 syslogng.conf

  • 772

我正在将一个 Solaris 框从 syslogd 移动到 syslog-ng，因为 syslogd 的 Solaris 版本删除了日志中的原始源主机名。我正在查看 syslogng.conf 文档，但不确定我是否完全理解它。我们有一个相对简单的 syslog.conf，我希望那里的 syslog-ng 专家可以告诉我如何将它“转换”为可用的 syslogng.conf？

#ident  "@(#)syslog.conf        1.5     98/12/14 SMI"   /* SunOS 5.0 */
#
# Copyright (c) 1991-1998 by Sun Microsystems, Inc.
# All rights reserved.
#
# syslog configuration file.
#
# This file is processed by m4 so be careful to quote (`') names
# that match m4 reserved words.  Also, within ifdef's, arguments
# containing commas must be quoted.
#
*.err;kern.notice;auth.notice                   /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit        /var/adm/messages

#*.alert;kern.err;daemon.err                    operator
#*.alert                                                root

*.emerg                                         *
local7.debug                                    /var/log/ncolog
audit.debug                                     /var/log/ncolog
local7.debug                                    @nimitz
audit.debug                                     @nimitz

# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice                    ifdef(`LOGHOST', /var/log/authlog, @loghost)

mail.debug                      ifdef(`LOGHOST', /var/log/syslog, @loghost)

#
# non-loghost machines will use the following lines to cause "user"
# log messages to be logged locally.
#
ifdef(`LOGHOST', ,
user.err                                        /dev/sysmsg
user.err                                        /var/adm/messages
#user.alert                                     `root, operator'
user.emerg                                      *
)
solaris unix syslog syslogd syslog-ng

1 个回答

  1. Best Answer

    一旦您了解了它的配置文件的结构，syslog-ng 就非常简单（但更冗长）。在像您这样的简单安装中，您现在需要知道的是您必须配置源、过滤器和目标。我不确定您运行的是哪个版本的 syslog-ng，但这是 3.0.x 的版本（也适用于更新的版本）：

    @version 3.0

# syslog source
source s_sys { sun-streams ("/dev/log" door("/var/run/syslog_door")); };

# use this instead if you receive logs from network:
# source s_sys { udp ();
#                sun-streams ("/dev/log" door("/var/run/syslog_door")); };

# destinations
destination d_sysmsg { file ("/dev/sysmsg"); };
destination d_messages { file ("/var/adm/messages"); };
destination d_ncolog { file ("/var/log/ncolog"); };
destination d_nimitz { udp ("nimitz"); };
destination d_auth { file ("/var/log/authlog"); };
destination d_syslog { file ("/var/log/syslog"); };
destination d_users { usertty ("*"); };

# filters
filter f_emerg { priority (emerg); };
filter f_sysmsg { priority (err..emerg) or
                  (facility (kern) or facility (auth)) and priority (notice..emerg); };
filter f_messages { priority (err..emerg) or
                    facility (kern) or
                    facility (daemon) and priority (notice..emerg) or
                    facility (mail) and priority (crit..emerg); };
filter f_local7 { facility (local7); };
filter f_audit { facility (13); };
filter f_mail { facility (mail); };

# log paths
log { source (s_sys); filter (f_emerg); destination (d_users); };
log { source (s_sys); filter (f_sysmsg); destination (d_sysmsg); };
log { source (s_sys); filter (f_messages); destination (d_messages); };
log { source (s_sys); filter (f_local7); destination (d_ncolog); destination (d_nimitz); };
log { source (s_sys); filter (f_audit); destination (d_ncolog); destination (d_nimitz); };
log { source (s_sys); filter (f_mail); destination (d_syslog); };

    我想我涵盖了除“ifdef”部分之外的所有内容。如果您的主机没有在本地保存日志，即它不是 LOGHOST，您必须添加另一个目的地

    destination d_loghost { udp ("loghost"); };

    并将邮件的日志路径更改为

    log { source (s_sys); filter (f_mail); destination (d_loghost); };
    • 3

相关问题