![Ubuntu 14.04.2 LTS-RSysLog 8.8.0-omusrmsg 不工作](https://linux22.com/image/654310/Ubuntu%2014.04.2%20LTS-RSysLog%208.8.0-omusrmsg%20%E4%B8%8D%E5%B7%A5%E4%BD%9C.png)
两天来我一直在尝试让 RSysLog 向所有 [或指定] 用户发出有关某些设施/优先级影响 RSysLog 的警报。
rsyslog.d/50-default.conf:
...
*.emerg :omusrmsg:*
...
命令
# logger -p emerg "Test Broadcast"
不向任何登录用户发送消息,但会在 /var/log/syslog 中创建条目。我在一台原装 Digital Ocean 14LTS Droplet 上尝试过这个,然后安装了 syslog-ng,它在那里运行良好。如果一切都失败了,我将不得不切换到 syslog-ng。
我尝试调试它,但没有发现任何结论,只是它应该调用其内部的 omusrmsg 插件。
6570.499968822:imuxsock.c : --------imuxsock calling select, active file descriptors (max 4):
0 4
6570.500000498:main Q:Reg/w0 : wti 0x1e55a80: worker awoke from idle processing
6570.500011205:main Q:Reg/w0 : DeleteProcessedBatch: we deleted 0 objects and enqueued 0 objects
6570.500018262:main Q:Reg/w0 : doDeleteBatch: delete batch from store, new sizes: log 1, phys 1
6570.500028026:main Q:Reg/w0 : processBATCH: batch of 1 elements must be processed
6570.500035307:main Q:Reg/w0 : processBATCH: next msg 0: <8>Mar 18 11:02:50 root: Test Broadcast
6570.500043692:main Q:Reg/w0 : PRIFILT 'auth,authpriv.*'
6570.500060156:main Q:Reg/w0 : pmask: X X X X FF X X X X X FF X X X X X X X
X X X X X X X X
6570.500212848:main Q:Reg/w0 : PRIFILT condition result is 0
6570.500219084:main Q:Reg/w0 : PRIFILT '*.*;auth,authpriv.none'
6570.500234875:main Q:Reg/w0 : pmask: FF FF FF FF X FF FF FF FF FF X FF FF FF FF FF FF FF F
F FF FF FF FF FF FF FF
6570.500376739:main Q:Reg/w0 : PRIFILT condition result is 1
6570.500383229:main Q:Reg/w0 : ACTION 1 [builtin:omfile:/var/log/syslog]
6570.500399749:main Q:Reg/w0 : executing action 1
6570.500406423:main Q:Reg/w0 : Called action, logging to builtin:omfile
6570.500434197:main Q:Reg/w0 : action 1 is transactional - executing in commit phase
6570.500442730:main Q:Reg/w0 : Action 1 transitioned to state: itx
6570.500449556:main Q:Reg/w0 : PRIFILT 'syslog.*'
6570.500464841:main Q:Reg/w0 : pmask: X X X X X FF X X X X X X X X X X X X
X X X X X X X X
6570.500600153:main Q:Reg/w0 : PRIFILT condition result is 0
6570.500606337:main Q:Reg/w0 : PRIFILT 'kern.*'
6570.500621174:main Q:Reg/w0 : pmask: FF X X X X X X X X X X X X X X X X X
X X X X X X X X
6570.500756319:main Q:Reg/w0 : PRIFILT condition result is 0
6570.500762583:main Q:Reg/w0 : PRIFILT 'mail.*'
6570.500779355:main Q:Reg/w0 : pmask: X X FF X X X X X X X X X X X X X X X
X X X X X X X X
6570.500917348:main Q:Reg/w0 : PRIFILT condition result is 0
6570.500922727:main Q:Reg/w0 : PRIFILT 'mail.err'
6570.500936390:main Q:Reg/w0 : pmask: X X F X X X X X X X X X X X X X X X
X X X X X X X X
6570.501051126:main Q:Reg/w0 : PRIFILT condition result is 0
6570.501056236:main Q:Reg/w0 : PRIFILT 'news.crit'
6570.501069057:main Q:Reg/w0 : pmask: X X X X X X X 7 X X X X X X X X X X
X X X X X X X X
6570.501190023:main Q:Reg/w0 : PRIFILT condition result is 0
6570.501195270:main Q:Reg/w0 : PRIFILT 'news.err'
6570.501208511:main Q:Reg/w0 : pmask: X X X X X X X F X X X X X X X X X X
X X X X X X X X
6570.501322879:main Q:Reg/w0 : PRIFILT condition result is 0
6570.501328029:main Q:Reg/w0 : PRIFILT 'news.notice'
6570.501341145:main Q:Reg/w0 : pmask: X X X X X X X 3F X X X X X X X X X X
X X X X X X X X
6570.501456323:main Q:Reg/w0 : PRIFILT condition result is 0
6570.501461494:main Q:Reg/w0 : PRIFILT '*.emerg'
6570.501474573:main Q:Reg/w0 : pmask: 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
1 1 1 1 1 1 1 1
6570.501596778:main Q:Reg/w0 : PRIFILT condition result is 1
6570.501602014:main Q:Reg/w0 : ACTION 9 [builtin:omusrmsg::omusrmsg:*]
6570.501616285:main Q:Reg/w0 : executing action 9
6570.501621661:main Q:Reg/w0 : Called action, logging to builtin:omusrmsg
6570.501638200:main Q:Reg/w0 : wti 0x1e55a80: we need to create a new action worker instance for
action 9
6570.501647455:main Q:Reg/w0 : Action 9 transitioned to state: itx
6570.501653556:main Q:Reg/w0 : entering actionCalldoAction(), state: itx, actionNbr 9
6570.501658963:main Q:Reg/w0 :
6570.501794730:main Q:Reg/w0 : Action 9 transitioned to state: rdy
6570.501804424:main Q:Reg/w0 : END batch execution phase, entering to commit phase
6570.501811294:main Q:Reg/w0 : actionCommitAll: action 1, state 1, nbr to commit 0 isTransactiona
l 1
6570.501817299:main Q:Reg/w0 : doTransaction: have commitTransaction IF, using that, pWrkrInfo 0x
1e55bc0
6570.501823086:main Q:Reg/w0 : entering actionCallCommitTransaction(), state: itx, actionNbr 1, n
Msgs 1
6570.501830453:main Q:Reg/w0 : omfile: write to stream, pData->pStrm 0x7fdf78002500, lenBuf 45, s
trt data Mar 18 11:02:50 phoenix root: Test Broadcast
6570.501838364:main Q:Reg/w0 : strm 0x7fdf78002500: file 5(syslog) flush, buflen 45
6570.501845555:main Q:Reg/w0 : strmPhysWrite, stream 0x7fdf78002500, len 45
6570.501861894:main Q:Reg/w0 : strm 0x7fdf78002500: file 5 write wrote 45 bytes
6570.501868452:main Q:Reg/w0 : Action 1 transitioned to state: rdy
6570.501874835:main Q:Reg/w0 : Action 1 transitioned to state: itx
6570.501880751:main Q:Reg/w0 : Action 1 transitioned to state: rdy
6570.501886462:main Q:Reg/w0 : actionCommit, in retry loop, iRet 0
6570.501892786:main Q:Reg/w0 : actionCommitAll: action 2, state 0, nbr to commit 0 isTransactiona
l 1
6570.501899897:main Q:Reg/w0 : actionCommitAll: action 3, state 0, nbr to commit 0 isTransactiona
l 1
6570.501906392:main Q:Reg/w0 : actionCommitAll: action 9, state 0, nbr to commit 0 isTransactiona
l 0
6570.501912074:main Q:Reg/w0 : processBATCH: batch of 1 elements has been processed
6570.501918697:main Q:Reg/w0 : regular consumer finished, iret=0, szlog 0 sz phys 1
6570.501925448:main Q:Reg/w0 : DeleteProcessedBatch: we deleted 1 objects and enqueued 0 objects
6570.501931248:main Q:Reg/w0 : doDeleteBatch: delete batch from store, new sizes: log 0, phys 0
6570.501937522:main Q:Reg/w0 : regular consumer finished, iret=4, szlog 0 sz phys 0
6570.501943253:main Q:Reg/w0 : main Q:Reg/w0: worker IDLE, waiting for work.
root@phoenix:~#
答案1
您是否在配置文件中使用$PrivDropToGroup
或$PrivDropToGroupID
?此组是否对用户终端具有写权限(默认情况下为 组tty
)?请注意(根据我对http://www.rsyslog.com/doc/droppriv.html) 如果指定了其中任何一个,则任何次要组都会被删除。
用户的终端是否可以由该组写入?您的用户是否运行mesg n
以关闭此功能?要检查这一点,请尝试以下操作...
-bash-4.1$ tty
/dev/pts/0
-bash-4.1$ ls -l /dev/pts/0
crw--w----. 1 sph9 tty 136, 0 Mar 23 22:59 /dev/pts/0
为了使 rsyslog 能够写入用户终端,它要么需要以用户身份运行root
(您说要避免这种情况),要么与具有写访问权限的组一起运行。上面的示例来自 CentOS 计算机,您可能会发现其他一些发行版具有更开放的权限(我刚刚查看的 Arch Linux 机器对组和其他人具有写访问权限)。
因此,如果每个终端仅对登录用户和组成员具有写入权限tty
和rsyslogd 正在以用户syslog
组身份运行syslog
,因此无法写入终端。您可以(我认为)通过临时更改其中一个 tty 上的组(根据需要替换 pts/0)来测试此理论...
chgrp rsyslog /dev/pts/0
如果有效,那么您可以尝试将 rsyslog 设置为以组身份运行tty
(尽管如果您依赖于特定组拥有的日志文件,这可能会破坏其他事情)。
请注意,这一切都基于对 rsyslog 文档的快速阅读以及对其一般工作原理的经验,而不是对 rsyslog 最新版本的具体经验。
用户的登录会话是否正确记录在 utmp 中?(即它们是否显示在w
? 的输出中)。刚遇到https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/1366261这表明 AppArmor、rsyslogd 和 utmp 存在问题,但那是早期版本的问题。
答案2
我尝试将 syslog 添加到 tty 组:
sudo adduser syslog tty
service rsyslog restart
重新登录后似乎就可以正常工作了。
只是为了好玩,难以阅读但更通用的版本:
adduser $(awk '/^\$PrivDropToUser/ {print $2}' /etc/rsyslog.conf) $(stat -c "%G" $(tty))