一、rsyslog的作用负责按照策略采集系统中生成的日志并把日志按照规则存放到相应文件中二、存放日志类别日志文件日志种类/var/log/messages服务信息服务启动报错/var/log/secure认证信息日志/var/log/maillog邮件日志/var/log/cron定时任务日志/var/log/boot.log系统启动日志三、日志采集规则编写日志类型auth用户认证authpriv服务认证cron定时任务kern内核日志mail邮件日志news更新信息日志user用户日志2.日志级别info信息notice重要信息debug程序排错waring警告日志err报错crit严重报错alert必须马上更改emerg系统的严重问题日志none日志不采集3.日志采集标识方式事例*.* #所有类型的所有级别日志authpriv.err #服务认证的报错日志*.*;auth.none #所有类型的所有级别日志除了用户认证的日志之外4.配置文件编写方式[rootnode1 log]# vim /etc/rsyslog.conf*.* action(typeomfile file/var/log/lee)[rootnode1 log]# systemctl restart rsyslog.service[rootnode1 log]# cat /var/log/leeJul 21 14:48:57 node1 systemd[1]: Stopping System Logging Service...Jul 21 14:48:58 node1 rsyslogd[2396]: [origin softwarersyslogd swVersion8.2510.0-2.el9 x-pid2396 x-infohttps://www.rsyslog.com] exiting on signal 15.Jul 21 14:48:58 node1 systemd[1]: rsyslog.service: Deactivated successfully.Jul 21 14:48:58 node1 systemd[1]: Stopped System Logging Service.Jul 21 14:48:58 node1 systemd[1]: Starting System Logging Service...Jul 21 14:48:58 node1 systemd[1]: Started System Logging Service.Jul 21 14:48:58 node1 rsyslogd[2616]: [origin softwarersyslogd swVersion8.2510.0-2.el9 x-pid2616 x-infohttps://www.rsyslog.com] startJul 21 14:48:58 node1 rsyslogd[2616]: imjournal: journal files changed, reloading... [v8.2510.0-2.el9 try https://www.rsyslog.com/e/0 ]#测试服务认证日志是否出现在lee中[rootnode2 ~]# ssh -l root 172.25.254.10[rootnode1 log]# cat /var/log/leeJul 21 14:50:39 node1 sshd-session[2644]: Accepted publickey for root from 172.25.254.10 port 45796 ssh2: ED25519 SHA256:CKTIw27nljWVDPSEqqek8eByGRwaYRHnG3k4mghmfY8Jul 21 14:50:39 node1 systemd-logind[744]: New session 7 of user root.Jul 21 14:50:39 node1 systemd[1]: Started Session 7 of User root.Jul 21 14:50:39 node1 sshd-session[2644]: pam_unix(sshd:session): session opened for user root(uid0) by root(uid0)Jul 21 14:50:40 node1 systemd[1]: Starting Hostname Service...Jul 21 14:50:40 node1 systemd[1]: Started Hostname Service.#在lee中如何不采集服务认证日志[rootnode1 log]# vim /etc/rsyslog.conf*.*;authpriv.none action(typeomfile file/var/log/lee)[rootnode1 log]# systemctl restart rsyslog.service[rootnode1 log]# /var/log/lee[rootnode2 ~]# ssh -l root 172.25.254.10[rootnode1 log]# cat /var/log/leeJul 21 14:53:06 node1 systemd[1]: session-7.scope: Deactivated successfully.Jul 21 14:53:06 node1 systemd-logind[744]: Session 7 logged out. Waiting for processes to exit.Jul 21 14:53:06 node1 systemd-logind[744]: Removed session 7.Jul 21 14:53:08 node1 systemd[1]: session-5.scope: Deactivated successfully.Jul 21 14:53:08 node1 systemd-logind[744]: Session 5 logged out. Waiting for processes to exit.Jul 21 14:53:08 node1 systemd-logind[744]: Removed session 5.Jul 21 14:53:11 node1 systemd-logind[744]: New session 8 of user root.Jul 21 14:53:11 node1 systemd[1]: Started Session 8 of User root.Jul 21 14:53:11 node1 systemd[1]: Starting Hostname Service...Jul 21 14:53:11 node1 systemd[1]: Started Hostname Service.5.自定义日志采集格式参数解释%timegenerated% #日志生成时间%FROMHOST-IP% #生成日志主机IP%syslogtag% #生成日志程序名称: #分隔符%msg% #日志内容[rootnode1 ~]# vim /etc/rsyslog.conf$template LEE, %timegenerated% %FROMHOST-IP% %syslogtag%: %msg%\n*.*;authpriv.none action(typeomfile templateLEE file/var/log/lee)[rootnode1 ~]# systemctl restart rsyslog.service测试[rootnode1 ~]# /var/log/lee[rootnode1 ~]# cat /var/log/leeJul 21 15:19:30 127.0.0.1 root[3266]:: tetJul 21 15:19:33 127.0.0.1 root[3267]:: testJul 21 15:19:37 127.0.0.1 root[3268]:: hahahahaha四、远程日志同步1.设定接受日志的主机#开启接受日志的端口和插件[rootnode1 ~]# vim /etc/rsyslog.confmodule(loadimudp) # needs to be done just onceinput(typeimudp port514)[rootnode1 ~]# netstat -antlupe | grep rsyslogudp 0 0 0.0.0.0:514 0.0.0.0:* 0 37000 3344/rsyslogdudp6 0 0 :::514 :::* 02.在远程主机中设定日志同步[rootnode2 ~]# vim /etc/rsyslog.conf*.* 172.25.254.10[rootnode2 ~]# systemctl restart rsyslog.service3.测试[rootnode1 ~]# /var/log/messages#在远程主机中生成日志[rootnode2 ~]# logger test#在日志服务器中查看日志[rootnode1 ~]# cat /var/log/messagesJul 21 15:30:05 node2 root[2575]: test注意此处需要辨别使用的是udp还是tcp如果是使用tcp则需要两个符udp只需要一个符