主页 / server / 问题 / 766145
Accepted
BioRod
Asked: 2016-03-26 10:37:05 +0800 CST

远程 rsyslog 客户端/服务器问题

  • 772

我只希望 rsyslog 将日志发送到集中式 rsyslog 服务器，但它也在本地发送它们。这是出于法律原因，服务器不会有日志目录，只有集中的 rsyslog 服务器会有日志。

我想通过在客户端的 rsyslog.conf 中使用'&~'，它只会远程发送日志，但我错了。

这是集中的 rsyslog 服务器配置：

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
$ModLoad immark   # provides --MARK-- message capability

module(load="imudp") # needs to be done just once
input(type="imudp" port="514")

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$klogConsoleLogLevel 3

$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

*.info;*.!warn;\
    authpriv.none;cron.none;mail.none;news.none     -/var/log/messages

*.warn;\
    authpriv.none;cron.none;mail.none;news.none     -/var/log/syslog

*.=debug                                                -/var/log/debug
authpriv.*                                              -/var/log/secure
cron.*                                                  -/var/log/cron
mail.*                                                  -/var/log/maillog
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          -/var/log/spooler

$template TmplAuth, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"
$template TmplMsg, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"

authpriv.*   ?TmplAuth
*.info,mail.none,authpriv.none,cron.none   ?TmplMsg

这是客户端配置：

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
$ModLoad immark   # provides --MARK-- message capability
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$klogConsoleLogLevel 3
$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
*.info;*.!warn;\
    authpriv.none;cron.none;mail.none;news.none     -/var/log/messages &~
*.warn;\
    authpriv.none;cron.none;mail.none;news.none     -/var/log/syslog

*.=debug                                                -/var/log/debug
authpriv.*                                              -/var/log/secure
cron.*                                                  -/var/log/cron
mail.*                                                  -/var/log/maillog
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          -/var/log/spooler
if $syslogfacility-text == 'local6' and $programname == 'httpd' then   /var/log/httpd-access.log
if $syslogfacility-text == 'local6' and $programname == 'httpd' then ~
if $syslogfacility-text == 'local7' and $programname == 'httpd' then /var/log/httpd-error.log
if $syslogfacility-text == 'local7' and $programname == 'httpd' then ~
rsyslog

1 个回答

  1. Best Answer

    你可能有语法问题。尝试使用换行符编写规则，如下所示：

    if $syslogfacility-text == 'local6' and $programname == 'httpd' then /var/log/httpd-access.log &
~

    或者更好的是，您可以使用现代 RainerScript 语法而不是传统格式：

    if ( $syslogfacility-text == 'local6' and $programname == 'httpd' )
then {
    action(type="omfile" file="/var/log/httpd-access.log")
    stop
}

    它更冗长，更不模棱两可。

    • 1

相关问题