用rsyslog的缘由:

1.防止系统崩溃无法获取系统日志分享崩溃原因,用rsyslog可以把日志传输到远程的日志服务器上
2.使用rsyslog日志可以减轻系统压力,因为使用rsyslog可以有效减轻系统的磁盘IO
3.rsyslog使用tcp传输非常可靠,可以对日志进行过滤,提取出有效的日志,rsyslog是轻量级的日志软件,在大量日志写的情况下,系统负载基本上在0.1以下

一、安装前准备
1.下载rsyslog-5.6.2
2.准备两台机器(linux或者unix),一台客户端,一台服务端

服务端和客户端的安装步骤:


  1. #指定安装目录

  2. ./configure --prefix=/Application/rsyslog

  3. #编译

  4. make

  5. #安装

  6. make install

  7. #添加lib

  8. echo "/Application/rsyslog/lib/rsyslog" >> /etc/ld.so.conf

  9. #更新lib

  10. ldconfig

  11. #产生配置文件

  12. cp /etc/syslog.conf /etc/rsyslog.conf

#产生服务文件
vi /etc/init.d/rsyslog
  1. #!/bin/bash

  2. #

  3. # rsyslog Starts rsyslogd/rklogd.

  4. #

  5. #

  6. # chkconfig: - 12 88

  7. # description: Syslog is the facility by which many daemons use to log \

  8. # messages to various system log files. It is a good idea to always \

  9. # run rsyslog.

  10. ### BEGIN INIT INFO

  11. # Provides: $syslog

  12. # Required-Start: $local_fs $network $remote_fs

  13. # Required-Stop: $local_fs $network $remote_fs

  14. # Default-Stop: 0 1 2 3 4 5 6

  15. # Short-Description: Enhanced system logging and kernel message trapping daemons

  16. # Description: Rsyslog is an enhanced multi-threaded syslogd supporting,

  17. # among others, MySQL, syslog/tcp, RFC 3195, permitted

  18. # sender lists, filtering onany message part, and fine

  19. # grain output format control.

  20. ### END INIT INFO

  21. # Source function library.

  22. basedir=/Application/rsyslog

  23. moddir=/Application/rsyslog/lib/rsyslog/

  24. rsyslogdfile=$basedir/sbin/rsyslogd

  25. . /etc/init.d/functions

  26. RETVAL=0

  27. start() {

  28. [ -x $rsyslogdfile ] || exit 5

  29. # Do not start rsyslog when sysklogd is running

  30. if [ -e /var/run/syslogd.pid ] ; then

  31. echo $"Shut down sysklogd before you run rsyslog";

  32. exit 1;

  33. fi

  34. # Source config

  35. if [ -f /etc/sysconfig/rsyslog ] ; then

  36. . /etc/sysconfig/rsyslog

  37. else

  38. SYSLOGD_OPTIONS="-M $moddir"

  39. fi

  40. if [ -z "$SYSLOG_UMASK" ] ; then

  41. SYSLOG_UMASK=077;

  42. fi

  43. umask $SYSLOG_UMASK

  44. echo -n $"Starting system logger: "

  45. daemon $rsyslogdfile $SYSLOGD_OPTIONS

  46. RETVAL=$?

  47. echo

  48. [ $RETVAL -eq 0 ] && touch /var/lock/subsys/rsyslog

  49. return $RETVAL

  50. }

  51. stop() {

  52. echo -n $"Shutting down system logger: "

  53. killproc $rsyslogdfile

  54. RETVAL=$?

  55. echo

  56. [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/rsyslog

  57. return $RETVAL

  58. }

  59. reload() {

  60. RETVAL=1

  61. syslog=`cat /var/run/rsyslogd.pid 2>/dev/null`

  62. echo -n "Reloading system logger..."

  63. if [ -n "${syslog}" ] && [ -e /proc/"${syslog}" ]; then

  64. kill -HUP "$syslog";

  65. RETVAL=$?

  66. fi

  67. if [ $RETVAL -ne 0 ]; then

  68. failure

  69. else

  70. success

  71. fi

  72. echo

  73. return $RETVAL

  74. }

  75. rhstatus() {

  76. status rsyslogd

  77. }

  78. restart() {

  79. stop

  80. start

  81. }

  82. case"$1"in

  83. start)

  84. start

  85. ;;

  86. stop)

  87. stop

  88. ;;

  89. restart)

  90. restart

  91. ;;

  92. reload|force-reload)

  93. reload

  94. ;;

  95. status)

  96. rhstatus

  97. ;;

  98. condrestart)

  99. [ -f /var/lock/subsys/rsyslog ] && restart || :

  100. ;;

  101. *)

  102. echo $"Usage: $0 {start|stop|restart|reload|force-reload|condrestart}"

  103. exit 2

  104. esac

  105. exit $?

#启动服务


  1. #产生服务文件

  2. chmod +x /etc/init.d/rsyslog

  3. #启动前先把syslog停止

  4. service syslog stop

  5. service rsyslog start

#配置服务端
vi /etc/rsyslog.conf #在文件开始加上,同时确保514端口能够被客户端用tcp访问
  1. #指定日志文件的拥有者

  2. $FileOwner apache

  3. #使用tcp方式

  4. $ModLoad imtcp # needs to be done just once

  5. #tcp接收连接数为500个

  6. $InputTCPMaxSessions 500

  7. #tcp接收信息的端口

  8. $InputTCPServerRun 514

  9. #为信息加上日志时间

  10. $template logformat,"%TIMESTAMP:::date-mysql% %FROMHOST-IP%%msg%\n"

  11. #定义的日志文件的名称,按照年月日

  12. $template DynFile,"/Application/sdns/log/%$year%%$month%%$day%.log"

  13. #把包含sdns_log标志的信息写到DynFile定义的日志文件里

  14. :rawmsg, contains, "sdns_log" ?DynFile;logformat

  15. #这个表示丢弃包含sdns_log标志的信息

  16. :rawmsg, contains, "sdns_log" ~

配置客户端

vi /etc/rsyslog.conf #在文件开始加上
  1. #把包含sdns_log的信息通过tcp发到192.168.1.2 @@表示tcp @表示udp

  2. :rawmsg, contains, "sdns_log" @@192.168.1.2

  3. #这个表示丢弃包含sdns_log标志的信息,防止这个信息写到本机的/var/log/message

  4. :rawmsg, contains, "sdns_log" ~

测试:
在客户端上执行
logger -p user.info "sdns_log 34334"
在服务端的/Application/sdns/log/目录里是否有日志产生