软件安装

在centos7，rsyslog默认安装，重点在于配置文件。

[root@localhost samba]# vim /etc/rsyslog.conf

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)

$ModLoad imjournal # provides access to the systemd journal

#####开启udp接收日志

$ModLoad imudp

$UDPServerRun 514

$template RemoteHost,"/data/syslog/%$YEAR%-%$MONTH%-%$DAY%/%FROMHOST-IP%.log"

*.* ?RemoteHost

& ~

####开启tcp协议接受日志

$ModLoad imtcp

$InputTCPServerRun 514

$WorkDirectory /var/lib/rsyslog

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#######启用/etc/rsyslog.d/*.conf目录下所有以.conf结尾的配置文件

$IncludeConfig /etc/rsyslog.d/*.conf

$OmitLocalLogging on

$IMJournalStateFile imjournal.state

*.info;mail.none;authpriv.none;cron.none /var/log/messages

authpriv.* /var/log/secure

mail.* -/var/log/maillog

cron.* /var/log/cron

*.emerg :omusrmsg:*

uucp,news.crit /var/log/spooler

local7.* /var/log/boot.log

local0.* /etc/keepalived/keepalived.log

[root@server98 log]# grep -v "^$" /etc/rsyslog.conf | grep -v "^#"

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)

$ModLoad imjournal # provides access to the systemd journal

$WorkDirectory /var/lib/rsyslog

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$template myFormat,"%timestamp% %fromhost-ip% %msg%\n" #######自定义模板的相关信息

$IncludeConfig /etc/rsyslog.d/*.conf

$OmitLocalLogging on

$IMJournalStateFile imjournal.state

*.* @192.168.99.99:514 ########该声明告诉rsyslog守护进程，将系统上各个设备的各种日志的所有消息路由到远程rsyslog服务器(192.168.99.99)的UDP端口514。@@是通过tcp传输，一个@是通过udp传输。

*.info;mail.none;authpriv.none;cron.none /var/log/messages

authpriv.* /var/log/secure

mail.* -/var/log/maillog

cron.* /var/log/cron

*.emerg :omusrmsg:*

uucp,news.crit /var/log/spooler

local7.* /var/log/boot.log

local0.* /etc/keepalived/keepalived.log