☰

在 rsyslogd 上拆分日志

tag-icon • tag-icon linux logging log-files rsyslog syslog
在 rsyslogd 上拆分日志

我的目标是将所有日志发送到一个远程源，并且仍在本地记录，然后将所有 AuditD 日志发送到端口 20002 上的自己的源。但由于某种原因，我的 auditd 日志仍然以我的系统日志进入端口 20000 结束

/etc/rsyslog.conf：

cat /etc/rsyslog.conf
module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # provides kernel logging support

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf

local7.* ~

auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
cron.*                         /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log

mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err

*.=debug;\
        auth,authpriv.none;\
        mail.none               -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail.none               -/var/log/messages

*.emerg                         :omusrmsg:*

/etc/rsyslog.d/rsyslog_d_all.conf：

*.*;!local7.* action(type="omfwd" target="10.10.1.23" port="20000" protocol="tcp")

rsyslog_d_auditd.conf：

$ModLoad imfile
local7.* action(type="omfwd" target="10.10.1.23" port="20002" protocol="tcp")
$InputFileName /var/log/audit/audit.log
$InputFileTag tag_audit_log:
$InputFileStateFile audit_log
$InputFileSeverity info
$InputFileFacility local6
$InputRunFileMonitor

相关内容