一.rsyslog的作用负责按照策略采集系统中生成的日志并把日志按照规则存放到相应文件中二.存放日志类别日志文件日志种类/var/log/messages服务信息服务启动报错/var/log/secure认证信息日志/var/log/maillog邮件日志/var/log/cron定时任务日志/var/log/boot.log系统启动日志三.日志采集规则编写1.日志类型auth用户认证authpriv服务认证cron定时任务kern内核日志mail邮件日志news更新信息日志user用户日志2.日志级别info信息notice重要信息debug程序排错waring警告日志err报错crit严重报错alert必须马上更改emerg系统的严重问题日志none日志不采集3.日志采集标识方式示例*.*#所有类型的所有级别日志authpriv.err#服务认证的报错日志*.*;auth.none#所有类型的所有级别日志除了用户认证的日志之外4,配置文件编写方式[rootnode1 log]# vim /etc/rsyslog.conf*.* action(typeomfilefile/var/log/lee)[rootnode1 log]# systemctl restart rsyslog.service[rootnode1 log]# cat /var/log/leeJul2114:48:57 node1 systemd[1]: Stopping System Logging Service... Jul2114:48:58 node1 rsyslogd[2396]:[originsoftwarersyslogdswVersion8.2510.0-2.el9x-pid2396x-infohttps://www.rsyslog.com]exiting on signal15. Jul2114:48:58 node1 systemd[1]: rsyslog.service: Deactivated successfully. Jul2114:48:58 node1 systemd[1]: Stopped System Logging Service. Jul2114:48:58 node1 systemd[1]: Starting System Logging Service... Jul2114:48:58 node1 systemd[1]: Started System Logging Service. Jul2114:48:58 node1 rsyslogd[2616]:[originsoftwarersyslogdswVersion8.2510.0-2.el9x-pid2616x-infohttps://www.rsyslog.com]start Jul2114:48:58 node1 rsyslogd[2616]: imjournal: journal files changed, reloading...[v8.2510.0-2.el9 try https://www.rsyslog.com/e/0]#测试服务认证日志是否出现在lee中[rootnode2 ~]# ssh -l root 172.25.254.10[rootnode1 log]# cat /var/log/leeJul2114:50:39 node1 sshd-session[2644]: Accepted publickeyforroot from172.25.254.10 port45796ssh2: ED25519 SHA256:CKTIw27nljWVDPSEqqek8eByGRwaYRHnG3k4mghmfY8 Jul2114:50:39 node1 systemd-logind[744]: New session7of user root. Jul2114:50:39 node1 systemd[1]: Started Session7of User root. Jul2114:50:39 node1 sshd-session[2644]: pam_unix(sshd:session): session openedforuser root(uid0)by root(uid0)Jul2114:50:40 node1 systemd[1]: Starting Hostname Service... Jul2114:50:40 node1 systemd[1]: Started Hostname Service.#在lee中如何不采集服务认证日志[rootnode1 log]# vim /etc/rsyslog.conf*.*;authpriv.none action(typeomfilefile/var/log/lee)[rootnode1 log]# systemctl restart rsyslog.service[rootnode1 log]# /var/log/lee[rootnode2 ~]# ssh -l root 172.25.254.10[rootnode1 log]# cat /var/log/leeJul2114:53:06 node1 systemd[1]: session-7.scope: Deactivated successfully. Jul2114:53:06 node1 systemd-logind[744]: Session7logged out. Waitingforprocesses to exit. Jul2114:53:06 node1 systemd-logind[744]: Removed session7. Jul2114:53:08 node1 systemd[1]: session-5.scope: Deactivated successfully. Jul2114:53:08 node1 systemd-logind[744]: Session5logged out. Waitingforprocesses to exit. Jul2114:53:08 node1 systemd-logind[744]: Removed session5. Jul2114:53:11 node1 systemd-logind[744]: New session8of user root. Jul2114:53:11 node1 systemd[1]: Started Session8of User root. Jul2114:53:11 node1 systemd[1]: Starting Hostname Service... Jul2114:53:11 node1 systemd[1]: Started Hostname Service.5.自定义日志采集格式参数解释:%timegenerated%#日志生成时间%FROMHOST-IP%#生成日志主机IP%syslogtag%#生成日志程序名称:#分隔符%msg%#日志内容[rootnode1 ~]# vim /etc/rsyslog.conf#模板$templateLEE,%timegenerated% %FROMHOST-IP% %syslogtag%: %msg%\n#使用模板的配置*.*;authpriv.none action(typeomfiletemplateLEEfile/var/log/lee)[rootnode1 ~]# systemctl restart rsyslog.service#注意 模板内容需要写在使用模板的配置内容之前测试:[rootnode1 ~]# /var/log/lee[rootnode1 ~]# logger tet[rootnode1 ~]# logger test[rootnode1 ~]# logger hahahahaha[rootnode1 ~]# cat /var/log/leeJul2115:19:30127.0.0.1 root[3266]:: tet Jul2115:19:33127.0.0.1 root[3267]::testJul2115:19:37127.0.0.1 root[3268]:: hahahahaha四.远程日志同步1.设定接收日志的主机#开启接受日志的端口和插件[rootnode1 ~]# vim /etc/rsyslog.confmodule(loadimudp)# needs to be done just onceinput(typeimudpport514)[rootnode1 ~]# netstat -antlupe | grep rsyslogudp000.0.0.0:5140.0.0.0:*0370003344/rsyslogd udp600:::514 :::*0370013344/rsyslogd2.设定发送日志的主机远程主机下的接收日志文件格式自定义需要配置在远程主机中[rootnode2 ~]# vim /etc/rsyslog.conf*.* 172.25.254.10[rootnode2 ~]# systemctl restart rsyslog.service3.测试:[rootnode1 ~]# /var/log/messages#在远程主机中生成日志[rootnode2 ~]# logger test#在日志服务器中查看日志[rootnode1 ~]# cat /var/log/messagesJul2115:30:05 node2 root[2575]:test