![从 syslog.conf 移至 syslogng.conf](https://linux22.com/image/589617/%E4%BB%8E%20syslog.conf%20%E7%A7%BB%E8%87%B3%20syslogng.conf.png)
我正在将 Solaris 机器从 syslogd 移到 syslog-ng,因为 Solaris 版本的 syslogd 会抹去日志中的原始源主机名。我正在查看 syslogng.conf 文档,但不确定我是否完全理解了它。我们有一个相对简单的 syslog.conf,我希望 syslog-ng 专家能告诉我如何将其“转换”为可行的 syslogng.conf?
#ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */
#
# Copyright (c) 1991-1998 by Sun Microsystems, Inc.
# All rights reserved.
#
# syslog configuration file.
#
# This file is processed by m4 so be careful to quote (`') names
# that match m4 reserved words. Also, within ifdef's, arguments
# containing commas must be quoted.
#
*.err;kern.notice;auth.notice /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit /var/adm/messages
#*.alert;kern.err;daemon.err operator
#*.alert root
*.emerg *
local7.debug /var/log/ncolog
audit.debug /var/log/ncolog
local7.debug @nimitz
audit.debug @nimitz
# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost)
mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost)
#
# non-loghost machines will use the following lines to cause "user"
# log messages to be logged locally.
#
ifdef(`LOGHOST', ,
user.err /dev/sysmsg
user.err /var/adm/messages
#user.alert `root, operator'
user.emerg *
)
答案1
一旦你理解了 syslog-ng 的配置文件结构,它就变得非常简单(但冗长很多)。在像你这样的简单安装中,你现在需要知道的只是必须配置源、过滤器和目标。我不确定你运行的是哪个版本的 syslog-ng,但这里有一个适用于 3.0.x 的版本(也适用于较新的版本):
@version 3.0
# syslog source
source s_sys { sun-streams ("/dev/log" door("/var/run/syslog_door")); };
# use this instead if you receive logs from network:
# source s_sys { udp ();
# sun-streams ("/dev/log" door("/var/run/syslog_door")); };
# destinations
destination d_sysmsg { file ("/dev/sysmsg"); };
destination d_messages { file ("/var/adm/messages"); };
destination d_ncolog { file ("/var/log/ncolog"); };
destination d_nimitz { udp ("nimitz"); };
destination d_auth { file ("/var/log/authlog"); };
destination d_syslog { file ("/var/log/syslog"); };
destination d_users { usertty ("*"); };
# filters
filter f_emerg { priority (emerg); };
filter f_sysmsg { priority (err..emerg) or
(facility (kern) or facility (auth)) and priority (notice..emerg); };
filter f_messages { priority (err..emerg) or
facility (kern) or
facility (daemon) and priority (notice..emerg) or
facility (mail) and priority (crit..emerg); };
filter f_local7 { facility (local7); };
filter f_audit { facility (13); };
filter f_mail { facility (mail); };
# log paths
log { source (s_sys); filter (f_emerg); destination (d_users); };
log { source (s_sys); filter (f_sysmsg); destination (d_sysmsg); };
log { source (s_sys); filter (f_messages); destination (d_messages); };
log { source (s_sys); filter (f_local7); destination (d_ncolog); destination (d_nimitz); };
log { source (s_sys); filter (f_audit); destination (d_ncolog); destination (d_nimitz); };
log { source (s_sys); filter (f_mail); destination (d_syslog); };
我想我涵盖了除“ifdef”部分之外的所有内容。如果您的主机没有在本地保存日志,即它不是 LOGHOST,则必须添加另一个目标
destination d_loghost { udp ("loghost"); };
并将邮件的日志路径更改为
log { source (s_sys); filter (f_mail); destination (d_loghost); };