建站
咨詢(xún)
售后
建站咨詢(xún)
新聞中心
這里有您想知道的互聯(lián)網(wǎng)營(yíng)銷(xiāo)解決方案
Rsyslog日志轉(zhuǎn)發(fā)到Logstash具體方法
rsyslog 是一個(gè) syslogd 的多線程增強(qiáng)版。 現(xiàn)在Fedora和Ubuntu, rhel6默認(rèn)的日志系統(tǒng)都是rsyslog了 rsyslog負(fù)責(zé)寫(xiě)入日志, logrotate負(fù)責(zé)備份和刪除舊日志, 以及更新日志文件
在烏蘭等地區(qū)，都構(gòu)建了全面的區(qū)域性戰(zhàn)略布局，加強(qiáng)發(fā)展的系統(tǒng)性、市場(chǎng)前瞻性、產(chǎn)品創(chuàng)新能力，以專(zhuān)注、極致的服務(wù)理念，為客戶(hù)提供成都網(wǎng)站建設(shè)、做網(wǎng)站 網(wǎng)站設(shè)計(jì)制作定制網(wǎng)站開(kāi)發(fā),公司網(wǎng)站建設(shè),企業(yè)網(wǎng)站建設(shè),品牌網(wǎng)站建設(shè),成都全網(wǎng)營(yíng)銷(xiāo),外貿(mào)營(yíng)銷(xiāo)網(wǎng)站建設(shè),烏蘭網(wǎng)站建設(shè)費(fèi)用合理。
版本：
-
Rsyslog V5
-
Logstash 5.2.2
配置文件
就不做過(guò)多的介紹了直接貼測(cè)試通過(guò)的rsyslog.conf配置文件該配置文件的目錄為：/etc/rsyslog.conf
# rsyslog v5 configuration file
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html
#### MODULES ####
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
#$ModLoad immark # provides --MARK-- message capability
# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514
# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514
#### GLOBAL DIRECTIVES ####
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on
# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf
#### RULES ####
# Log all kernel messages to the console.
# Logging much else clutters up the screen.(內(nèi)核)
kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!(記錄的內(nèi)核消息、各種服務(wù)的公共消息，報(bào)錯(cuò)信息等)
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.(包含驗(yàn)證和授權(quán)方面信息)
authpriv.* /var/log/secure
# Log all the mail messages in one place.(包含來(lái)著系統(tǒng)運(yùn)行電子郵件服務(wù)器的日志信息)
mail.* -/var/log/maillog
# Log cron stuff(每當(dāng)cron進(jìn)程開(kāi)始一個(gè)工作時(shí)，就會(huì)將相關(guān)信息記錄在這個(gè)文件中)
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log(自定義的消息)
local7.* /var/log/boot.log
$ModLoad imfile #裝載imfile模塊
$InputFileName /opt/tomcat/apache-tomcat-8.5.15/logs/catalina.out #讀取日志文件
$InputFileTag catalina: #日志寫(xiě)入日志附加標(biāo)簽字符串
$InputFileFacility local5 #日志類(lèi)型
$InputFileSeverity info #日志等級(jí)
$InputFileStateFile ssologs.log_state #定義記錄偏移量數(shù)據(jù)文件名
$InputFilePollInterval 1 #檢查日志文件間隔（秒）
$InputFilePersistStateInterval 1 #回寫(xiě)偏移量數(shù)據(jù)到文件間隔時(shí)間（秒）
$InputRunFileMonitor #激活讀取，可以設(shè)置多組日志讀取，每組結(jié)束時(shí)設(shè)置本參數(shù)。以示生效。
$InputFileName /opt/tomcat/apache-tomcat-8.5.15/logs/localhost_access_log.%$year%-%$month%-%$day%.txt #讀取日志文件
$InputFileTag access: #日志寫(xiě)入日志附加標(biāo)簽字符串
$InputFileFacility local6 #日志類(lèi)型
$InputFileSeverity info #日志等級(jí)
$InputFileStateFile sssologs.log_state #定義記錄偏移量數(shù)據(jù)文件名
$InputFilePollInterval 1 #檢查日志文件間隔（秒）
$InputFilePersistStateInterval 1 #回寫(xiě)偏移量數(shù)據(jù)到文件間隔時(shí)間（秒）
$InputRunFileMonitor #激活讀取，可以設(shè)置多組日志讀取，每組結(jié)束時(shí)設(shè)置本參數(shù)。以示生效。
# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$WorkDirectory /var/lib/rsyslog # where to place spool files
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList # run asynchronously
#$ActionResumeRetryCount -1 # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
*.* @10.255.0.167:514
# ### end of the forwarding rule ###
# A template to for higher precision timestamps + severity logging
$template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
:programname, startswith, "spice-vdagent" /var/log/spice-vdagent.log;SpiceTmpl
上面文件中：
#*.* @remote-host:514 *.*即表示轉(zhuǎn)發(fā)所有設(shè)備的日志信息 @表示使用UDP協(xié)議傳輸 @@表示使用TCP協(xié)議傳輸 找到上面這句去掉前面的#號(hào)然后添加對(duì)應(yīng)的IP和端口即可。 例： . @10.255.0.165:514
如果你只想要轉(zhuǎn)發(fā)服務(wù)器上的指定設(shè)備的日志消息，比如說(shuō)內(nèi)核設(shè)備，那么你可以在rsyslog配置文件中使用以下聲明。 kern.* @10.255.0.165:514
修改完成后執(zhí)行service rsyslog restart 重新啟動(dòng)rsyslong 即可。
Logstash配置
input {
udp {
port => 514
type => syslog
}
}
filter {
if [type] == "syslog" {
grok {
patterns_dir => "/opt/logstash/logstash-5.2.2/patterns"
match => { "message" => "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
}
}
}
output{
elasticsearch {
hosts => ["10.255.0.167"]
index => "rsyslog_test"
}
stdout{
codec => rubydebug
}
}
最后更新配置：/etc/init.d/rsyslog restart 附：Logstash的配置很簡(jiǎn)單只是監(jiān)聽(tīng)514端口就可以了，但是使用grok切日志才是麻煩的，畢竟那么多種的日志每種都要寫(xiě)對(duì)應(yīng)的正則。
分享名稱(chēng)：Rsyslog日志轉(zhuǎn)發(fā)到Logstash具體方法
當(dāng)前路徑：http://www.5511xx.com/article/cdhscoh.html
