zoukankan      html  css  js  c++  java
  • rsyslog日志收集分析

    1.rsyslog的server配置

    [root@VM_0_34_centos 0413]# cat /etc/rsyslog.conf |egrep -v '^#|^$'
    $ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
    $ModLoad imjournal # provides access to the systemd journal
    $ModLoad imudp
    $UDPServerRun 514
    $ModLoad imtcp
    $InputTCPServerRun 514
    $InputTCPMaxSessions 500 
    $FileOwner dev 
    $template logformat,"%TIMESTAMP% %FROMHOST-IP%%msg%
    "   
    $template DynFile,"/mnt/data/logs/rsyslogs/%$year%%$month%%$day%.log"   
    $AllowedSender TCP, 10.0.0.0/24
    $template Remote,"/mnt/data/logs/rsyslogs/%fromhost-ip%/%fromhost-ip%_%$YEAR%-%$MONTH%-%$DAY%.log"
    :fromhost-ip, !isequal, "127.0.0.1" ?Remote
    $WorkDirectory /var/lib/rsyslog
    $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
    $IncludeConfig /etc/rsyslog.d/*.conf
    $OmitLocalLogging on
    $IMJournalStateFile imjournal.state
    *.info;mail.none;authpriv.none;cron.none                /var/log/messages
    authpriv.*                                              /var/log/secure
    mail.*                                                  -/var/log/maillog
    cron.*                                                  /var/log/cron
    *.emerg                                                 :omusrmsg:*
    uucp,news.crit                                          /var/log/spooler
    local7.*                                                /var/log/boot.log
    $ModLoad ommysql
    *.info;mail.none;authpriv.none;cron.none    :ommysql:10.0.0.134,Syslog,rsyslogdbadmin,rsyslog.ppp

    2.rsyslog的client配置

    [root@VM_0_12_centos ~]# cat  /etc/rsyslog.conf |egrep -v  '^$|^#'
    $ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
    $ModLoad imjournal # provides access to the systemd journal
    $WorkDirectory /var/lib/rsyslog
    $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
    $IncludeConfig /etc/rsyslog.d/*.conf
    $OmitLocalLogging on
    $IMJournalStateFile imjournal.state
    *.info;mail.none;authpriv.none;cron.none                /var/log/messages
    authpriv.*                                              /var/log/secure
    mail.*                                                  -/var/log/maillog
    cron.*                                                  /var/log/cron
    *.emerg                                                 :omusrmsg:*
    uucp,news.crit                                          /var/log/spooler
    local7.*                                                /var/log/boot.log
    *.* @@10.0.0.34:514

    3.web页面分析

    参考:https://www.cnblogs.com/th-lyc/p/11703190.html    https://www.cnblogs.com/hanyifeng/p/5474147.html

  • 相关阅读:
    P3932 浮游大陆的68号岛
    P4595 [COCI2011-2012#5] POPLOCAVANJE
    CF455E Function
    【转载】乱堆的东西
    BZOJ1034 [ZJOI2008]泡泡堂BNB[贪心]
    CSP2019退役记
    BZOJ5206 [Jsoi2017]原力[根号分治]
    luogu3651 展翅翱翔之时 (はばたきのとき)[基环树+贪心]
    BZOJ1040 [ZJOI2008]骑士[基环树DP]
    BZOJ3037 创世纪[基环树DP]
  • 原文地址:https://www.cnblogs.com/hixiaowei/p/12692506.html
Copyright © 2011-2022 走看看