不知何故，我的 rsyslogd 初始化脚本不起作用。我尝试启用 rsyslogd 以接受 udp:514 上的日志数据。
如果我通过 Init-Script 启动 rsyslogd，则不会转发任何日志数据。甚至 syslog 也不会转发！而且不会绑定任何端口。
netstat -plantu | grep 514 | grep LISTEN
ps -ef | grep sysl
root 7330 1 0 Jun21 ? 00:00:00 /sbin/mdadm --monitor --pid-file /run/mdadm/monitor.pid --daemonise --scan --syslog
root 16448 26559 0 10:35 pts/3 00:00:00 grep --color=auto sysl
root 19573 14931 0 09:55 pts/5 00:00:00 tail -f /var/log/syslog
如果我以 root 身份通过控制台启动 rsyslogd，一切都运行正常。
root@server:/etc# which rsyslogd
/usr/sbin/rsyslogd
root@server:/etc# rsyslogd
... {Output trunnked}
2736.651185540:7fb7b0357780: Checking pidfile '/var/run/rsyslogd.pid'.
root@server:/etc netstat -plantu | grep 514 | grep udp
udp 0 0 127.0.0.1:514 0.0.0.0:* 22762/rsyslogd
/etc/rsyslog.conf
# /etc/rsyslog.conf Configuration file for rsyslog.
#
# For more information see
# /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf
#################
#### MODULES ####
#################
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support
#$ModLoad immark # provides --MARK-- message capability
# provides UDP syslog reception
$ModLoad imudp
$UDPServerAddress 127.0.0.1
$UDPServerRun 514
# provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514
# Enable non-kernel facility klog messages
$KLogPermitNonKernelFacility on
###########################
#### GLOBAL DIRECTIVES ####
###########################
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Filter duplicated messages
$RepeatedMsgReduction on
#
# Set the default permissions for all log files.
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog
#
# Where to place spool and state files
#
$DebugFile /var/log/rsyslog.log
$DebugLevel 2
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
/etc/rsyslog.d/49-haproxy.conf
local1.* /var/log/haproxy.log
local0.* /var/log/haproxy-details.log
对于缺失的 /dev/xconsole (https://askubuntu.com/questions/108924/missing-dev-xconsole-causes-rsyslog-to-stop-as-well-as-all-other-services我修改了文件 /etc/rsyslog.d/50-默认.conf
# Default rules for rsyslog.
#
# For more information see rsyslog.conf(5) and /etc/rsyslog.conf
#
# First some standard log files. Log by facility.
#
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none,local0.none,local1.none -/var/log/syslog
#cron.* /var/log/cron.log
#daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
#lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
#user.* -/var/log/user.log
#
# Logging for the mail system. Split it up so that
# it is easy to write scripts to parse these files.
#
#mail.info -/var/log/mail.info
#mail.warn -/var/log/mail.warn
mail.err /var/log/mail.err
#
# Logging for INN news system.
#
news.crit /var/log/news/news.crit
news.err /var/log/news/news.err
news.notice -/var/log/news/news.notice
#
# Some "catch-all" log files.
#
*.=debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
local0,local1,mail,news.none -/var/log/messages
#
# Emergencies are sent to everybody logged in.
#
*.emerg :omusrmsg:*
#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
# news.=crit;news.=err;news.=notice;\
# *.=debug;*.=info;\
# *.=notice;*.=warn /dev/tty8
# The named pipe /dev/xconsole is for the `xconsole' utility. To use it,
# you must invoke `xconsole' with the `-file' option:
#
# $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
# busy site..
#
#daemon.*;mail.*;\
# news.err;\
# *.=debug;*.=info;\
# *.=notice;*.=warn |/dev/xconsole
根据Rsyslogd 没有监听端口，我修改了/etc/apparmor.d/usr.sbin.rsyslogd
# Last Modified: Sun Sep 25 08:58:35 2011
#include <tunables/global>
# Debugging the syslogger can be difficult if it can't write to the file
# that the kernel is logging denials to. In these cases, you can do the
# following:
# watch -n 1 'dmesg | tail -5'
/usr/sbin/rsyslogd {
#include <abstractions/base>
#include <abstractions/nameservice>
network inet dgram,
network inet6 dgram,
network inet stream,
network inet6 stream,
capability sys_tty_config,
capability dac_override,
capability dac_read_search,
capability setuid,
capability setgid,
capability sys_nice,
capability syslog,
# rsyslog configuration
/etc/rsyslog.conf r,
/etc/rsyslog.d/ r,
/etc/rsyslog.d/** r,
/{,var/}run/rsyslogd.pid rwk,
/var/spool/rsyslog/ r,
/var/spool/rsyslog/** rwk,
/usr/lib{,32,64}/rsyslog/*.so mr,
/dev/tty* rw,
/dev/xconsole rw,
@{PROC}/kmsg r,
/dev/log rwl,
/var/lib/*/dev/log wl,
/var/spool/postfix/dev/log wl,
# 'r' is needed when using imfile
/var/log/** rw,
# Add these for mysql support
#/etc/mysql/my.cnf r,
#/{,var/}run/mysqld/mysqld.sock rw,
# Add thes for postgresql support
##include <abstractions/openssl>
##include <abstractions/ssl_certs>
#/{,var/}run/postgresql/.s.PGSQL.*[0-9] rw,
# Site-specific additions and overrides. See local/README for details.
#include <local/usr.sbin.rsyslogd>
}
Apparmor 状态
root@server:~# apparmor_status
apparmor module is loaded.
9 profiles are loaded.
9 profiles are in enforce mode.
/sbin/dhclient
/usr/lib/NetworkManager/nm-dhcp-client.action
/usr/lib/connman/scripts/dhclient-script
/usr/lib/libvirt/virt-aa-helper
/usr/sbin/libvirtd
/usr/sbin/ntpd
libvirt-7715abf7-991b-4b74-90bf-14ed26914d3b
libvirt-a4d428db-ca82-45b4-9f27-af7564c8ce78
libvirt-ecede722-e23c-4f66-9194-3ddd4522b7d8
0 profiles are in complain mode.
5 processes have profiles defined.
5 processes are in enforce mode.
/usr/sbin/libvirtd (1159)
/usr/sbin/ntpd (1497)
libvirt-7715abf7-991b-4b74-90bf-14ed26914d3b (17524)
libvirt-a4d428db-ca82-45b4-9f27-af7564c8ce78 (8124)
libvirt-ecede722-e23c-4f66-9194-3ddd4522b7d8 (30950)
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
root@server:~# ls -lah /etc/apparmor.d/disable/usr.sbin.rsyslogd
lrwxrwxrwx 1 root root 33 Mar 17 2014 /etc/apparmor.d/disable/usr.sbin.rsyslogd -> /etc/apparmor.d/usr.sbin.rsyslogd
环境信息：
root@server:~# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 14.04.4 LTS
Release: 14.04
Codename: trusty
root@server:~# rsyslogd -v
rsyslogd 7.4.4, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
Runtime Instrumentation (slow code): No
uuid support: Yes
See http://www.rsyslog.com for more information.
有什么想法可以说服 rsyslog 正确通过 init 启动吗？
答案1
* 更新 *我注释掉了所有条目在 /etc/默认/rsyslog 中。
# Options for rsyslogd
# -x disables DNS lookups for remote messages
# See rsyslogd(8) for more details
#$ModLoad imudp
#$UDPServerRun 514
#RSYSLOGD_OPTIONS=""
现在使用“service rsyslog start”重新启动就可以了。
root@server:~# netstat -plantu | grep 514 | grep udp
udp 0 0 127.0.0.1:514 0.0.0.0:* 24632/rsyslogd