cd /etc/yum.repos.d;wget http://rpms.adiscon.com/v8-stable/rsyslog.repo
uat-web02:/etc/yum.repos.d# ls -ltr
total 32
-rw-r--r--. 1 root root 4528 Dec 1 2013 CentOS-Vault.repo
-rw-r--r--. 1 root root 630 Dec 1 2013 CentOS-Media.repo
-rw-r--r--. 1 root root 638 Dec 1 2013 CentOS-Debuginfo.repo
-rw-r--r-- 1 root root 227 Apr 1 2014 rsyslog.repo
-rw-r--r--. 1 root root 1083 Jul 2 2014 epel.repo
-rw-r--r--. 1 root root 2572 Jul 2 2014 CentOS-Base.repo
-rw-r--r-- 1 root root 1250 Aug 26 2014 puppetlabs.repo
uat-web02:/etc/yum.repos.d# cat rsyslog.repo
[rsyslog_v8]
name=Adiscon CentOS-$releasever - local packages for $basearch
baseurl=http://rpms.adiscon.com/v8-stable/epel-$releasever/$basearch
enabled=1
gpgcheck=0
gpgkey=http://rpms.adiscon.com/RPM-GPG-KEY-Adiscon
protect=1
uat-web02:/etc/yum.repos.d# ps -ef | grep rsyslog
root 32378 31761 0 09:29 pts/0 00:00:00 grep rsyslog
uat-web02:/etc/yum.repos.d# service rsyslog start
Starting system logger: [ OK ]
uat-web02:/etc/yum.repos.d# rsyslogd -v
rsyslogd 8.21.0, compiled with:
PLATFORM: x86_64-redhat-linux-gnu
PLATFORM (lsb_release -d):
FEATURE_REGEXP: Yes
GSSAPI Kerberos 5 support: No
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
memory allocator: system default
Runtime Instrumentation (slow code): No
uuid support: Yes
Number of Bits in RainerScript integers: 64
See http://www.rsyslog.com for more information.
安装rsyslog日志搜集
yum install rsyslog
查看版本信息
yum info rsyslog
修改配置文件：
[root@Server2 yum.repos.d]# cat /etc/rsyslog.conf |egrep -v "^(#|$)"
module(load="imuxsock") # provides support for local system logging (e.g. via logger command)
module(load="imklog") # provides kernel logging support (previously done by rklogd)
module(load="imudp") # needs to be done just once
input(type="imudp" port="514")
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* /var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
$template TmplAuth, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"
$template TmplMsg, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"
authpriv.* ?TmplAuth
*.info,mail.none,authpriv.none,cron.none ?TmplMsg
创建日志保存路径
mkdir -p /var/log/rsyslog_custom
semanage fcontext -a -t syslogd_exec_t /sbin/rsyslogd
restorecon /sbin/rsyslogd
/usr/sbin/semanage fcontext -a -t var_log_t "/var/log/rsyslog_custom(/.*)?"
/sbin/restorecon -R -v /var/log/rsyslog_custom
service rsyslog restart
查看udp 514端口是否开放
客户端安装rsyslog
cd /etc/yum.repos.d;wget http://rpms.adiscon.com/v8-stable/rsyslog.repo
yum install rsyslog
修改配置文件：
[root@Server1 yum.repos.d]# cat /etc/rsyslog.conf |egrep -v "^(#|$)"
module(load="imuxsock") # provides support for local system logging (e.g. via logger command)
module(load="imklog") # provides kernel logging support (previously done by rklogd)
module(load="imfile")
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* /var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
*.info /var/log/test.log
input(type="imfile"
File="/usr/local/nginx/logs/icms.access.log"
Tag="icms-access"
Severity="info"
Facility="local5")
*.* @192.168.0.103:514
验证：
在/var/log/rsyslog_custom目录下面：按服务器名称生成的文件夹，查看里面日志
注意:rsyslog 源码安装 会出现日志重复发的情况,需要rpm包安装