![rsyslogd 上的拆分日志记录](https://linux22.com/image/221978/rsyslogd%20%E4%B8%8A%E7%9A%84%E6%8B%86%E5%88%86%E6%97%A5%E5%BF%97%E8%AE%B0%E5%BD%95.png)
我的目标是将所有日志发送到一个远程源并仍然记录本地日志,然后将所有 AuditD 日志发送到端口 20002 上的自己的源。但由于某种原因,我的auditd 日志仍然以我的 syslogs 发送到端口 20000 结束
/etc/rsyslog.conf:
cat /etc/rsyslog.conf
module(load="imuxsock") # provides support for local system logging
module(load="imklog") # provides kernel logging support
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf
local7.* ~
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
cron.* /var/log/cron.log
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
mail.info -/var/log/mail.info
mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
*.=debug;\
auth,authpriv.none;\
mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail.none -/var/log/messages
*.emerg :omusrmsg:*
/etc/rsyslog.d/rsyslog_d_all.conf:
*.*;!local7.* action(type="omfwd" target="10.10.1.23" port="20000" protocol="tcp")
rsyslog_d_auditd.conf:
$ModLoad imfile
local7.* action(type="omfwd" target="10.10.1.23" port="20002" protocol="tcp")
$InputFileName /var/log/audit/audit.log
$InputFileTag tag_audit_log:
$InputFileStateFile audit_log
$InputFileSeverity info
$InputFileFacility local7
$InputRunFileMonitor
答案1
遗留的语法
选择器!
、!=
、 或是优先级的 前缀=
,而不是设施的前缀。更高版本的 rsyslogd 可能会!local7.*
因为语法无效而拒绝。local7
使用时不匹配
*.*;local7.!* action(...)