![远程 rsyslog 客户端/服务器问题](https://linux22.com/image/679490/%E8%BF%9C%E7%A8%8B%20rsyslog%20%E5%AE%A2%E6%88%B7%E7%AB%AF%2F%E6%9C%8D%E5%8A%A1%E5%99%A8%E9%97%AE%E9%A2%98.png)
我只希望 rsyslog 将日志发送到集中式 rsyslog 服务器,但它也会将日志发送到本地。这是出于法律原因,服务器不会有日志目录,只有集中式 rsyslog 服务器才会有日志。
我以为通过在客户端的 rsyslog.conf 中使用“&~”,它只会远程发送日志,但我错了。
以下是集中式 rsyslog 服务器配置:
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
$ModLoad immark # provides --MARK-- message capability
module(load="imudp") # needs to be done just once
input(type="imudp" port="514")
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$klogConsoleLogLevel 3
$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
*.info;*.!warn;\
authpriv.none;cron.none;mail.none;news.none -/var/log/messages
*.warn;\
authpriv.none;cron.none;mail.none;news.none -/var/log/syslog
*.=debug -/var/log/debug
authpriv.* -/var/log/secure
cron.* -/var/log/cron
mail.* -/var/log/maillog
*.emerg :omusrmsg:*
uucp,news.crit -/var/log/spooler
$template TmplAuth, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"
$template TmplMsg, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"
authpriv.* ?TmplAuth
*.info,mail.none,authpriv.none,cron.none ?TmplMsg
这是客户端配置:
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
$ModLoad immark # provides --MARK-- message capability
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$klogConsoleLogLevel 3
$FileOwner root
$FileGroup root
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
*.info;*.!warn;\
authpriv.none;cron.none;mail.none;news.none -/var/log/messages &~
*.warn;\
authpriv.none;cron.none;mail.none;news.none -/var/log/syslog
*.=debug -/var/log/debug
authpriv.* -/var/log/secure
cron.* -/var/log/cron
mail.* -/var/log/maillog
*.emerg :omusrmsg:*
uucp,news.crit -/var/log/spooler
if $syslogfacility-text == 'local6' and $programname == 'httpd' then /var/log/httpd-access.log
if $syslogfacility-text == 'local6' and $programname == 'httpd' then ~
if $syslogfacility-text == 'local7' and $programname == 'httpd' then /var/log/httpd-error.log
if $syslogfacility-text == 'local7' and $programname == 'httpd' then ~
答案1
你可能遇到了语法问题。尝试像这样使用换行符编写规则:
if $syslogfacility-text == 'local6' and $programname == 'httpd' then /var/log/httpd-access.log &
~
或者更好的是,您可以使用现代 RainerScript 语法来代替传统格式:
if ( $syslogfacility-text == 'local6' and $programname == 'httpd' )
then {
action(type="omfile" file="/var/log/httpd-access.log")
stop
}
它更加详细并且更少歧义。