☰

rsyslog的用户配置不起作用

tag-icon • tag-icon linux embedded rsyslog rsyslogd
rsyslog的用户配置不起作用

我试图向用户提供为 rsyslog 添加用户配置选项的选项。默认的 rsyslog 对我来说工作得很好。

rsyslog 文件的主要或默认配置如下所示：

# if you experience problems, check
# http://www.rsyslog.com/troubleshoot for assistance

# rsyslog v3: load input modules
# If you do not load inputs, nothing happens!
# You may need to set the module load path if modules are not found.
#
# Ported from debian's sysklogd.conf

$ModLoad immark   # provides --MARK-- message capability
$ModLoad imuxsock # provides support for local system logging (e.g. via 
logger command)
$ModLoad imklog   # kernel logging (formerly provided by rklogd)

# Enable traditional timestamp format                                                                                                                                                                            
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#
# Set the default permissions
#
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

## Include custom config fragments
##
$IncludeConfig /usr/local/etc/rsyslog.d/*.conf
$IncludeConfig /tmp/rsyslog.d/*.conf

# Default logs
auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
cron.*                          /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err

# Logging for INN news system
#
news.crit                       /var/log/news.crit
news.err                        /var/log/news.err
news.notice                     -/var/log/news.notice

#
# Some `catch-all' logfiles.
#
 *.=debug;\
    auth,authpriv.none;\
    news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail,news.none          -/var/log/messages

 #
 # Emergencies are sent to everybody logged in.
 #
 *.emerg                         :omusrmsg:*

 # Save boot messages also to boot.log
 local7.*                                                /var/log/boot.log

我的 rsyslog 过滤器文件如下所示，位于 /etc/rsyslog.ab.conf

##############################################################################
  ##                                                                            
  #
  ## Security relevant user authentication tags                                 
  #
  ##                                                                            
  #
  ## ALS, ALF                                                                   
  #

  ###############################################################################
  #$template ALS_sshd,"<38>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% 
  %PROCID% %MSGID% %STRUCTURED-DATA% ALS : %msg%\n"
  #if $programname contains 'sshd' and $msg contains 'Accepted password' then 
  /var/log/sedl.log;ALS_sshd
  #if $programname contains 'sshd' and $msg contains 'Accepted password' then 
  @128.224.124.147;ALS_sshd

  #$template ALS_login,"<38>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% 
  %PROCID% %MSGID% %STRUCTURED-DATA% ALS : %msg%\n"
  #if $programname contains 'login' and $msg contains 'login' then 
  /var/log/sedl.log;ALS_login
  #if $programname contains 'login' and $msg contains 'login' then 
  @128.224.124.147;ALS_login

  $template ALF_sshdPW,"<38>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% 
  %PROCID% %MSGID% %STRUCTURED-DATA% ALF : %msg%\n"
  if $programname contains 'sshd' and $msg contains 'Failed password' then 
  /var/log/sedl.log;ALF_sshdPW
  if $programname contains 'sshd' and $msg contains 'Failed password' then 
  @128.224.124.147;ALF_sshdPW

如果我取消注释上面示例中的“if's”，它可以正常工作，但是如果我将此文件移动到/usr/local/etc/rsyslog.d/*.conf未注释的“if's”，它就不起作用。即使我添加了 $IncludeConfig ，/usr/local/etc/rsyslog.d/*.conf它应该可以正常工作。但是，它只在 /etc/*conf 中起作用，而不是因为/usr/local/etc/rsyslog.d/*conf.我尝试使用 $ResetConfigVariables 但没有起作用。

尽管我在系统日志中看到了日志条目。

我使用的rsyslog版本是7.4.4。任何指示将不胜感激。谢谢

相关内容