如何搭建日志服务器？rsyslog日志服务器搭建配置教程

驰网飞飞

1、rsyslog 介绍
rsyslog 是一个快速处理收集系统日志的开源程序，提供了高性能、安全功能和模块化设计。rsyslog 是 syslog 的升级版，它将多种来源输入输出转换结果到目的地， rsyslog 被广泛用于 Linux 系统以通过 TCP/UDP 协议转发或接收日志消息。

如何搭建日志服务器？rsyslog日志服务器搭建配置教程

如何搭建日志服务器？rsyslog日志服务器搭建配置教程

rsyslog 守护进程可以被配置成两种环境，一种是配置成日志收集服务器，rsyslog 进程可以从网络中收集其它主机上的日志数据，这些主机会将日志配置为发送到另外的远程服务器。rsyslog 的另外一个用法，就是可以配置为客户端，用来过滤和发送内部日志消息到本地文件夹（如 /var/log）或一台可以路由到的远程 rsyslog 服务器上。

2、实验目的
实现 Client 主机通过 rsyslog 发送自身的系统日志到 Rsyslog Server 服务器，服务器端将该主机系统日志存放到一个指定的目录里面，进行按 IP 和日志简单分类存储。

3、实验环境
服务端和客户端系统都为 Centos7.7
服务端 IP：10.0.0.120　　客户端 IP：10.0.0.100
服务端和客户端关闭防火墙和 selinux

1. systemctl stop firewalld
   
2. setenforce 0

复制代码

服务端和客户端都安装 rsyslog 服务

1. yum -y install rsyslog　　#无网络自行配置 yum 源

复制代码

4、配置服务端

1. vim /etc/rsyslog.conf　　#修改rsyslog配置文件，标蓝的即为需要的内容，标红的为解释说明
   
2. # rsyslog configuration file
   
3. # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
   
4. # If you experience problems, see [url]http://www.rsyslog.com/doc/troubleshoot.html[/url]
   
5. #### MODULES ####
   
6. # The imjournal module bellow is now used as a message source instead of imuxsock.
   
7. $ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
   
8. $ModLoad imjournal # provides access to the systemd journal
   
9. #$ModLoad imklog # reads kernel messages (the same are read from journald)
   
10. #$ModLoad immark # provides --MARK-- message capability
    
11. # Provides UDP syslog reception
    
12. $ModLoad imudp
    
13. $UDPServerRun 514
    
14. # Provides TCP syslog reception
    
15. $ModLoad imtcp
    
16. $InputTCPServerRun 514
    
17. #### GLOBAL DIRECTIVES ####
    
18. # Where to place auxiliary files
    
19. $WorkDirectory /var/lib/rsyslog
    
20. $AllowedSender udp, 10.0.0.0/24
    
21. #收集的IP网段
    
22. # Use default timestamp format
    
23. $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
    
24. $template Remote,"/opt/n9e/rsyslog/logs/%fromhost-ip%/%fromhost-ip%_%$YEAR%-%$MONTH%-%$DAY%-%$HOUR%.log" 　　#定义模板，接受日志文件路径，区分了不同主机的日志，日志目录自行指定
    
25. :fromhost-ip, !isequal, "127.0.0.1" ?Remote　　# 过滤服务端本机的日志
    
26. # File syncing capability is disabled by default. This feature is usually not required,
    
27. # not useful and an extreme performance hit
    
28. #$ActionFileEnableSync on
    
29. # Include all config files in /etc/rsyslog.d/
    
30. $IncludeConfig /etc/rsyslog.d/*.conf
    
31. # Turn off message reception via local log socket;
    
32. # local messages are retrieved through imjournal now.
    
33. $OmitLocalLogging on
    
34. # File to store the position in the journal
    
35. $IMJournalStateFile imjournal.state
    
36. #### RULES ####
    
37. # 添加创建目录的注释
    
38. $CreateDirs on
    
39. # Log all kernel messages to the console.
    
40. # Logging much else clutters up the screen.
    
41. #kern.* /dev/console
    
42. # Log anything (except mail) of level info or higher.
    
43. # Don't log private authentication messages!
    
44. *.info;mail.none;authpriv.none;cron.none /var/log/messages
    
45. # The authpriv file has restricted access.
    
46. authpriv.* /var/log/secure
    
47. # Log all the mail messages in one place.
    
48. mail.* -/var/log/maillog
    
49. # Log cron stuff
    
50. cron.* /var/log/cron
    
51. # Everybody gets emergency messages
    
52. *.emerg :omusrmsg:*
    
53. # Save news errors of level crit and higher in a special file.
    
54. uucp,news.crit /var/log/spooler
    
55. # Save boot messages also to boot.log
    
56. local7.* /var/log/boot.log
    
57. # ### begin forwarding rule ###
    
58. # The statement between the begin ... end define a SINGLE forwarding
    
59. # rule. They belong together, do NOT split them. If you create multiple
    
60. # forwarding rules, duplicate the whole block!
    
61. # Remote Logging (we use TCP for reliable delivery)
    
62. #
    
63. # An on-disk queue is created for this action. If the remote host is
    
64. # down, messages are spooled to disk and sent when it is up again.
    
65. #$ActionQueueFileName fwdRule1 # unique name prefix for spool files
    
66. #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
    
67. #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
    
68. #$ActionQueueType LinkedList # run asynchronously
    
69. #$ActionResumeRetryCount -1 # infinite retries if host is down
    
70. # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
    
71. # *.* @@192.168.44.212:514
    
72. # ### end of the forwarding rule ###
    
73. systemctl restart rsyslog　　#重启rsyslog服务
    

复制代码

5、配置客户端

1. vim /etc/rsyslog.conf　　#修改rsyslog配置文件，标蓝的即为需要的内容，标红的为解释说明
   
2. # rsyslog configuration file
   
3. # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
   
4. # If you experience problems, see [url]http://www.rsyslog.com/doc/troubleshoot.html[/url]
   
5. #### MODULES ####
   
6. # The imjournal module bellow is now used as a message source instead of imuxsock.
   
7. $ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
   
8. $ModLoad imjournal # provides access to the systemd journal
   
9. #$ModLoad imklog # reads kernel messages (the same are read from journald)
   
10. #$ModLoad immark # provides --MARK-- message capability
    
11. # Provides UDP syslog reception
    
12. #$ModLoad imudp
    
13. #$UDPServerRun 514
    
14. # Provides TCP syslog reception
    
15. #$ModLoad imtcp
    
16. #$InputTCPServerRun 514
    
17. #### GLOBAL DIRECTIVES ####
    
18. # Where to place auxiliary files
    
19. $WorkDirectory /var/lib/rsyslog
    
20. # Use default timestamp format
    
21. $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
    
22. # File syncing capability is disabled by default. This feature is usually not required,
    
23. # not useful and an extreme performance hit
    
24. #$ActionFileEnableSync on
    
25. # Include all config files in /etc/rsyslog.d/
    
26. $IncludeConfig /etc/rsyslog.d/*.conf
    
27. # Turn off message reception via local log socket;
    
28. # local messages are retrieved through imjournal now.
    
29. $OmitLocalLogging on
    
30. # File to store the position in the journal
    
31. $IMJournalStateFile imjournal.state
    
32. #### RULES ####
    
33. # Log all kernel messages to the console.
    
34. # Logging much else clutters up the screen.
    
35. #kern.* /dev/console
    
36. # Log anything (except mail) of level info or higher.
    
37. # Don't log private authentication messages!
    
38. *.info;mail.none;authpriv.none;cron.none /var/log/messages
    
39. # The authpriv file has restricted access.
    
40. authpriv.* /var/log/secure
    
41. # Log all the mail messages in one place.
    
42. mail.* -/var/log/maillog
    
43. # Log cron stuff
    
44. cron.* /var/log/cron
    
45. # Everybody gets emergency messages
    
46. *.emerg :omusrmsg:*
    
47. # Save news errors of level crit and higher in a special file.
    
48. uucp,news.crit /var/log/spooler
    
49. # Save boot messages also to boot.log
    
50. local7.* /var/log/boot.log
    
51. # ### begin forwarding rule ###
    
52. # The statement between the begin ... end define a SINGLE forwarding
    
53. # rule. They belong together, do NOT split them. If you create multiple
    
54. # forwarding rules, duplicate the whole block!
    
55. # Remote Logging (we use TCP for reliable delivery)
    
56. #
    
57. # An on-disk queue is created for this action. If the remote host is
    
58. # down, messages are spooled to disk and sent when it is up again.
    
59. $ActionQueueFileName fwdRule1 # unique name prefix for spool files
    
60. $ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
    
61. $ActionQueueSaveOnShutdown on # save messages to disk on shutdown
    
62. $ActionQueueType LinkedList # run asynchronously
    
63. $ActionResumeRetryCount -1 # infinite retries if host is down
    
64. # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
    
65. #*.* @@remote-host:514
    
66. # ### end of the forwarding rule ###
    
67. *.* @10.0.0.120　　#指定服务端IP
    
68. systemctl restart rsyslog　　#重启rsyslog服务

复制代码

6、在服务端验证效果
切换到服务端存放日志文件的路径，可以看到已经生成了日志，rsyslog 日志服务配置成功。

如何搭建日志服务器？rsyslog日志服务器搭建配置教程

感谢您的阅读，服务器大本营-技术文章内容集合站，助您成为更专业的服务器管理员！