1.rsyslogd 服务
1.1服务功能
rsyslog是RHEL或centos系统6.x版本的日志服务，代替以前系统的syslog服务。在这个架构中rsyslog服务主要是收集日志的功能，把日志归类，写入数据库。 1.2服务配置文件
/etc/rsyslog.conf
1.2服务配置
### vim /etc/rsyslog.conf
service.loglevellogfile
*.* /var/log/all.log##所有服务的所有日志都放到/var/log/all.log中
2.日志同步
2.1在日志接收方
关闭接受方火墙systemctl stop firewalld
vim /etc/rsyslog.conf
$ModLoad imudp###加载日志接收功能模块
$UDPServerRun 514###加载日志接收接口
清空日志
监控
重启rsyslogd服务
2.2在日志发送方
*.*@日志接收方ip（UDP传输）
做完配置重启rsyslogd服务
2.3服务排错步骤：
检查防火墙开关
端口开关
是否重起
3.日志分析
systemd-journald###日志分析进程
journalctl ###日志分析命令
journalctl -n 5##查看最近生成的5条日志
journalctl -p err##查看系统报错
-f 监控日志
journalctl --since --until ###查看某个时间段生成的日志
journalctl -o verbose ###查看日志能够使用的条件参数
journalctl_UID=##进程uid
_PID=##进程id
_GID=##进程gid
_HOSTNAME=##进程所在主机
_SYSTEMD_UNIT=##服务名称
_COMM=##命令名称
_SYSTEMD_UNIT= _PID
4.日志监控工具的设定
默认情况下journalctl是无法看到关机之间产生的日志的
如果向检测到这类日志设置如下
[root@serverX ~]#mkdir /var/log/journal
[root@serverX ~]#chown root:systemd-journal /var/log/journal
[root@serverX ~]#chmod 2755 /var/log/journal
Send the USR1 signal to the systemd-journald or reboot serverX.
[root@serverX ~]#killall -1 systemd-journald
[root@serverX ~]#ls /var/log/journal/4513ad59a3b442ffa4b7ea88343fa55f
system.journal user-1000.journal
#journal
5.配置文件
1/etc/rsyslog.conf
2配置文件的基本信息
3配置文件中有很多内容, 但最主要的是指定需要记录哪些服务和需要记录什么等级的信息::
4cat /etc/rsyslog.conf
6 #rsyslog v3 config file
8 # if you experience problems, check
10 # http://www.rsyslog.com/troubleshoot for assistance
12 #### MODULES #### 加载 模块
14 $ModLoad imuxsock.so –> 模块名 # provides support for local system logging (e.g. via logger command) 本地系统日志
16 $ModLoad imklog.so # provides kernel logging support (previously done by rklogd)
18 #$ModLoad immark.so # provides –MARK– message capability
20 # Provides UDP syslog reception
22 # 允许514端口接收使用UDP协议转发过来的日志
24 #$ModLoad imudp.so
26 #$UDPServerRun 514
28 # Provides TCP syslog reception
30 # 允许514端口接收使用TCP协议转发过来的日志
32 #$ModLoad imtcp.so
34 #$InputTCPServerRun 514
36 #### GLOBAL DIRECTIVES ####
38 定义日志格式默认模板
40 # Use default timestamp format
42 $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
44 # File syncing capability is disabled by default. This feature is usually not required,
46 # not useful and an extreme performance hit
48 #$ActionFileEnableSync on
50 #### RULES ####
52 # Log all kernel messages to the console.
54 # Logging much else clutters up the screen.
56 #kern.* /dev/console 关于内核的所有日志都放到/dev/console(控制台)
58 # Log anything (except mail) of level info or higher.
60 # Don’t log private authentication messages!
62 # 记录所有日志类型的info级别以及大于info级别的信息到/var/log/messages，但是mail邮件信息，authpriv验证方面的信息和cron时间任务相关的信息除外
64 *.info;mail.none;authpriv.none;cron.none /var/log/messages
66 # The authpriv file has restricted access.
68 # authpriv验证相关的所有信息存放在/var/log/secure
70 authpriv.* /var/log/secure
72 # Log all the mail messages in one place.
74 # 邮件的所有信息存放在/var/log/maillog; 这里有一个-符号, 表示是使用异步的方式记录, 因为日志一般会比较大
76 mail.* -/var/log/maillog
78 # Log cron stuff
80 # 计划任务有关的信息存放在/var/log/cron
82 cron.* /var/log/cron
84 # Everybody gets emergency messages
86 # 记录所有的大于等于emerg级别信息, 以wall方式发送给每个登录到系统的
88 *.emerg * *代表所有在线用户
90 # Save news errors of level crit and higher in a special file.
92 # 记录uucp,news.crit等存放在/var/log/spooler
94 uucp,news.crit /var/log/spooler
96 # Save boot messages also to boot.log 启动的相关信息
98 local7.* /var/log/boot.log
100 #:rawmsg, contains, “sdns_log” @@192.168.56.7:10514
102 #:rawmsg, contains, “sdns_log”
104 # ### begin forwarding rule ### 转发规则
106 # The statement between the begin … end define a SINGLE forwarding
108 # rule. They belong together, do NOT split them. If you create multiple
110 # forwarding rules, duplicate the whole block!
112 # Remote Logging (we use TCP for reliable delivery)
114 #
116 # An on-disk queue is created for this action. If the remote host is
118 # down, messages are spooled to disk and sent when it is up again.
120 #$WorkDirectory /var/spppl/rsyslog # where to place spool files
122 #$ActionQueueFileName fwdRule1 # unique name prefix for spool files
124 #$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
126 #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
128 #$ActionQueueType LinkedList # run asynchronously
130 #$ActionResumeRetryCount -1 # infinite retries if host is down
132 # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
134 #*.* @@remote-host:514 # @@表示通过tcp协议发送 @表示通过udp进行转发
136 #local3.info @@localhost :514
138 #local7.* # @@192.168.56.7:514
140 # ### end of the forwarding rule ###
