![将包含特定字符串的消息记录到 rsyslogd 中的另一个文件中](https://linux22.com/image/1555625/%E5%B0%86%E5%8C%85%E5%90%AB%E7%89%B9%E5%AE%9A%E5%AD%97%E7%AC%A6%E4%B8%B2%E7%9A%84%E6%B6%88%E6%81%AF%E8%AE%B0%E5%BD%95%E5%88%B0%20rsyslogd%20%E4%B8%AD%E7%9A%84%E5%8F%A6%E4%B8%80%E4%B8%AA%E6%96%87%E4%BB%B6%E4%B8%AD.png)
我想通过 rsyslogd 将 iptables 生成的日志消息保存到另一个文件中。
目前我使用的代码来自/etc/rsyslog.d/20-custom.conf
:
# Log cron to cron.log and not to syslog
*.*;cron,auth,authpriv.none -/var/log/syslog
cron.* /var/log/cron.log
# Log firewall to extra log
:msg,contains,"[BLOCK " /var/log/firewall.log
& stop
我的 cron 日志很好,它们仅记录到cron.log
,但我的 iptables 日志同时记录到syslog
和firewall.log
。有没有办法只将其记录到firewall.log
?
我的系统规格:
> rsyslogd -v
rsyslogd 8.16.0, compiled with:
PLATFORM: x86_64-pc-linux-gnu
PLATFORM (lsb_release -d):
FEATURE_REGEXP: Yes
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
memory allocator: system default
Runtime Instrumentation (slow code): No
uuid support: Yes
Number of Bits in RainerScript integers: 64
Linux MYHOSTNAME 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
> lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04.4 LTS
Release: 16.04
Codename: xenial
答案1
您必须将防火墙日志记录部分移到其他规则之前,以便它看起来像
# Log firewall to extra log
:msg,contains,"[BLOCK " /var/log/firewall.log
& stop
# Log cron to cron.log and not to syslog
*.*;cron,auth,authpriv.none -/var/log/syslog
cron.* /var/log/cron.log
规则是按顺序考虑的,所以你现在有一条匹配的消息*.*;cron,auth,authpriv.none始终会写入系统日志,即使它也匹配:msg,包含,“[阻止”并写入到firewall.log。文件中的stop命令实在是太晚了,无法停止任何事情。
也可以看看https://www.rsyslog.com/writing-specific-messages-to-a-file-and-discarding-them/