Linux   发布时间:2022-04-01  发布网站:大佬教程  code.js-code.com
大佬教程收集整理的这篇文章主要介绍了linux – rsyslog没有记录消息大佬教程大佬觉得挺不错的,现在分享给大家,也给大家做个参考。

概述

我正在尝试设置我的ec2实例(运行amazon linux,据我所知是建立在RHel 5上)来将日志消息转发到loggentries.com,但没有任何东西被转发.作为一个完整性检查,我按照指令 in this article设置另一个ec2实例作为中央服务器,发现没有收到消息.所以我尝试在客户机上执行logger -p cron.info TEST,发现没有添加到/ var / log / cr
我正在尝试设置我的ec2实例(运行amazon linux,据我所知是建立在RHel 5上)来将日志消息转发到loggentries.com,但没有任何东西被转发.作为一个完整性检查,我按照指令 in this article设置另一个ec2实例作为中央服务器,发现没有收到消息.所以我尝试在客户机上执行logger -p cron.info TEST,发现没有添加到/ var / log / cron中!有些东西显然不起作用!但是rsyslogd正在运行:

输出

供参,这里是rsyslog.conf(暂时删除了转发内容,直到我在本地工作)

#### MODULES ####

$ModLoad imuxsock.so    # provides support for local system logging (e.g. via logger command)
$ModLoad imklog.so      # provides kernel logging support (prevIoUsly done by rklogd)
#$ModLoad immark.so     # provides --MARK-- message capability

# Provides UDP syslog reception
#$ModLoad imudp.so
#$UDPServerRun 514

# Provides TCP syslog reception
#$ModLoad imtcp.so  
#$InputTCPServerRun 514


#### GLOBAL DIRECTIVES ####

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,# not useful and an extreme perfoRMANce hit
#$ActionFileEnableSync on


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has reStricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

解决方法

您在rsyslog.conf中转发到远程IP地址唯一需要的是
*.* @@192.0.2.25:514;

关于你的其他问题……

确保在更改配置后重新启动rsyslogd;你还需要确保/ var / log / cron存在.

编辑

为了演示成功的日志条目是什么样的,我用rsyslogd -c4 -d开始了rsyslogd;这会将所有调试发送到我的ssh会话.我正在将cron.info记录到/ var / log / syslog.在一个不同的ssh会话中,我运行了logger -p cron.info“我的测试再次”…这是我在成功登录到/ var / log / syslog之前看到的…

4578.692833385:b6d8fb70: message from UNIX socket: #3
4578.692906216:b6d8fb70: logmsg: flags 4,from 'Bucksnort',msg Jul 15 10:02:58 mpenning: my test again
4578.692936284:b6d8fb70: message has legacy syslog format.
4578.692977796:b6d8fb70: main Q: entry added,size Now 1 entries
4578.693017277:b6d8fb70: wtpAdviseMaxWorkers signals busy
4578.693079869:b6d8fb70: main Q: EnqueueMsg advised worker start
4578.693117891:b6d8fb70: --------imuxsock calling SELEct,active file descriptors (max 5): 3 5
4578.693210533:b7590b70: main Q: entry deleted,state 0,size Now 0 entries
4578.693246128:b7590b70: tesTing filter,f_pmask 0
4578.693269892:b7590b70: tesTing filter,f_pmask 255
4578.693296429:b7590b70: Called action,logging to builTin-file
4578.693340007:b7590b70: file to log to: /var/log/syslog
4578.693369336:b7590b70: doWrite,PDAta->pStrm 0x96b6268,lenBuf 50
4578.693400172:b7590b70: strm 0x96b6268: file 7(syslog) flush,buflen 50
4578.693487314:b7590b70: strm 0x96b6268: file 7 write wrote 50 bytes
4578.693512965:b7590b70: tesTing filter,f_pmask 0
4578.693530524:b7590b70: tesTing filter,f_pmask 0
4578.693547988:b7590b70: tesTing filter,f_pmask 0
4578.693564966:b7590b70: tesTing filter,f_pmask 0
4578.693581783:b7590b70: tesTing filter,f_pmask 0
4578.693599197:b7590b70: tesTing filter,f_pmask 0
4578.693616153:b7590b70: tesTing filter,f_pmask 0
4578.693632854:b7590b70: tesTing filter,f_pmask 0
4578.693649647:b7590b70: tesTing filter,f_pmask 0
4578.693666837:b7590b70: tesTing filter,f_pmask 0
4578.693683852:b7590b70: tesTing filter,f_pmask 0
4578.693700593:b7590b70: tesTing filter,f_pmask 128
4578.693717070:b7590b70: tesTing filter,f_pmask 0
4578.693734486:b7590b70: tesTing filter,f_pmask 1
4578.693751624:b7590b70: tesTing filter,f_pmask 240
4578.693769534:b7590b70: Called action,logging to builTin-pipe
4578.693791155:b7590b70:  (/dev/xconsolE)
4578.693820288:b7590b70: main Q:reg/w0: worker IDLE,waiTing for work.

大佬总结

以上是大佬教程为你收集整理的linux – rsyslog没有记录消息全部内容,希望文章能够帮你解决linux – rsyslog没有记录消息所遇到的程序开发问题。

如果觉得大佬教程网站内容还不错,欢迎将大佬教程推荐给程序员好友。

本图文内容来源于网友网络收集整理提供,作为学习参考使用,版权属于原作者。
如您有任何意见或建议可联系处理。小编QQ:384754419,请注明来意。