☰

从 syslog.conf 移至 syslogng.conf

tag-icon • tag-icon unix solaris syslog syslog-ng syslogd
从 syslog.conf 移至 syslogng.conf

我正在将 Solaris 机器从 syslogd 移到 syslog-ng，因为 Solaris 版本的 syslogd 会抹去日志中的原始源主机名。我正在查看 syslogng.conf 文档，但不确定我是否完全理解了它。我们有一个相对简单的 syslog.conf，我希望 syslog-ng 专家能告诉我如何将其“转换”为可行的 syslogng.conf？

#ident  "@(#)syslog.conf        1.5     98/12/14 SMI"   /* SunOS 5.0 */
#
# Copyright (c) 1991-1998 by Sun Microsystems, Inc.
# All rights reserved.
#
# syslog configuration file.
#
# This file is processed by m4 so be careful to quote (`') names
# that match m4 reserved words.  Also, within ifdef's, arguments
# containing commas must be quoted.
#
*.err;kern.notice;auth.notice                   /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit        /var/adm/messages

#*.alert;kern.err;daemon.err                    operator
#*.alert                                                root

*.emerg                                         *
local7.debug                                    /var/log/ncolog
audit.debug                                     /var/log/ncolog
local7.debug                                    @nimitz
audit.debug                                     @nimitz

# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice                    ifdef(`LOGHOST', /var/log/authlog, @loghost)

mail.debug                      ifdef(`LOGHOST', /var/log/syslog, @loghost)

#
# non-loghost machines will use the following lines to cause "user"
# log messages to be logged locally.
#
ifdef(`LOGHOST', ,
user.err                                        /dev/sysmsg
user.err                                        /var/adm/messages
#user.alert                                     `root, operator'
user.emerg                                      *
)

答案1

一旦你理解了 syslog-ng 的配置文件结构，它就变得非常简单（但冗长很多）。在像你这样的简单安装中，你现在需要知道的只是必须配置源、过滤器和目标。我不确定你运行的是哪个版本的 syslog-ng，但这里有一个适用于 3.0.x 的版本（也适用于较新的版本）：

@version 3.0

# syslog source
source s_sys { sun-streams ("/dev/log" door("/var/run/syslog_door")); };

# use this instead if you receive logs from network:
# source s_sys { udp ();
#                sun-streams ("/dev/log" door("/var/run/syslog_door")); };

# destinations
destination d_sysmsg { file ("/dev/sysmsg"); };
destination d_messages { file ("/var/adm/messages"); };
destination d_ncolog { file ("/var/log/ncolog"); };
destination d_nimitz { udp ("nimitz"); };
destination d_auth { file ("/var/log/authlog"); };
destination d_syslog { file ("/var/log/syslog"); };
destination d_users { usertty ("*"); };

# filters
filter f_emerg { priority (emerg); };
filter f_sysmsg { priority (err..emerg) or
                  (facility (kern) or facility (auth)) and priority (notice..emerg); };
filter f_messages { priority (err..emerg) or
                    facility (kern) or
                    facility (daemon) and priority (notice..emerg) or
                    facility (mail) and priority (crit..emerg); };
filter f_local7 { facility (local7); };
filter f_audit { facility (13); };
filter f_mail { facility (mail); };

# log paths
log { source (s_sys); filter (f_emerg); destination (d_users); };
log { source (s_sys); filter (f_sysmsg); destination (d_sysmsg); };
log { source (s_sys); filter (f_messages); destination (d_messages); };
log { source (s_sys); filter (f_local7); destination (d_ncolog); destination (d_nimitz); };
log { source (s_sys); filter (f_audit); destination (d_ncolog); destination (d_nimitz); };
log { source (s_sys); filter (f_mail); destination (d_syslog); };

我想我涵盖了除“ifdef”部分之外的所有内容。如果您的主机没有在本地保存日志，即它不是 LOGHOST，则必须添加另一个目标

destination d_loghost { udp ("loghost"); };

并将邮件的日志路径更改为

log { source (s_sys); filter (f_mail); destination (d_loghost); };

相关内容