python syslog 接收服务 python发送syslog到服务器

转载

轩辕 2024-05-15 09:47:26

文章标签 python syslog 接收服务 ide html Logging 文章分类 Python 后端开发

1. bind 配置

这里只是定义了一个简单的 channel 详细的日志定义请查看

channel default_syslog {
                syslog local0;    //我们使用一个尚未使用 的local0 名称 
                severity dynamic;
         };

根据官当资料 http://web.mit.edu/darwin/src/modules/bind/bind/doc/html/logging.html

给出的建议如下：

Syntax
logging {
  [ channel channel_name {
    ( file path_name
       [ versions ( number | unlimited ) ]
       [ size size_spec ]
     | syslog ( kern | user | mail | daemon | auth | syslog | lpr |    //我们可以定义很多的syslog 发送的服务类型，在底部服务名称栏有详细描写
                news | uucp | cron | authpriv | ftp |
                local0 | local1 | local2 | local3 |
                local4 | local5 | local6 | local7 )
     | null );

    [ severity ( critical | error | warning | notice |
                 info  | debug [ level ] | dynamic ); ]
    [ print-category yes_or_no; ]
    [ print-severity yes_or_no; ]
    [ print-time yes_or_no; ]
  }; ]

  [ category category_name {
    channel_name; [ channel_name; ... ]
  }; ]
  ...
};

2.bind 服务器的 rsyslog 配置

[root@kube rsyslog.d]# cat /etc/rsyslog.conf 
# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

# The imjournal module bellow is now used as a message source instead of imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514


#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

#named DNS server log test   
local0.*                                                @10.2.61.22:514    //我们定义将本地rsyslog 接收的 loacl0 所有日志都发送到远程日志服务器  @udp   @@tcp
daemon.*                                                /var/log/named1.log
# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# ### end of the forwarding rule ###
[root@kube rsyslog.d]#

3. 远程日志服务器配置

[root@kube data]# cat /etc/rsyslog.conf
# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

# The imjournal module bellow is now used as a message source instead of imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
#$ModLoad imudp
$ModLoad imudp   // 开启日志服务器的 udp 514 端口监听
#$UDPServerRun 514
$UDPServerRun 514

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

local0.*                         /var/log/10.2.61.21_named.log    // 将收到 的 local0 的日志都保存到本地 的日志文件中

# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# ### end of the forwarding rule ###
[root@kube data]#

服务名称

syslog本身有设置一些服务，其他程序也可能设置一些，rsyslog设置的服务主要有下面这些，可以使用man 3 syslog查询到相关的信息。

服务类型	说明
auth	pam产生的日志，认证日志
authpriv	ssh，ftp等登录信息的验证信息
cron	就是例行工作调度cron/at等生成信息日志的地方
daemon	与各个daemon有关的信息
kern	内核kernel产生信息的地方
lpr	打印相关的信息
mail	只要与邮件收发有关的信息记录都属于这个
mark（syslog）	就是syslogd这个程序本身生成的信息
news	与新闻组服务器有关的东西
user	用户程序产生的相关信息
uucp	unix to unix copy，unix主机之间相关的通讯
local 1~7	自定义的日志设备

上面谈到的都是syslog自行制定的服务名称，软件开发商可以通过调用上述的服务名称来记录他们的软件。

信息等级

等级	等级名称	说明
1	info	一般信息的日志，最常用
2	notice	除了info外还需要注意的一些信息内容
3	warning（warn）	警示的信息，可能有问题，但是还不至于影响到某个daemon运行的信息；基本上info、notice、warn这三个信息都是在告知一些基本信息而已，应该还不至于造成一些系统运行困扰
4	err（error）	一些重大的错误信息，例如配置文件的某些设置造成该服务无法启动的信息说明，通常通过error的错误告知，应该可以了解到该服务无法启动的问题
5	crit	比error还要严重的错误信息，这个crit是临界点critcal的缩写，这个错误已经很严重了。
6	alert	警告，已经很有问题的等级，比crit还要严重
7	emerg（panic）	emergency/panic，急诊应急、疼痛、意指系统已经几乎要死机的状态！很严重的错误信息了。通常大概只有硬件出问题导致整个内核无法顺利运行，就会出现这样的等级的信息。