Linux下Rsyslog日志远程集中式管理

[root@rsyslog-server ~]# rpm -qa | grep rsyslog
[root@rsyslog-server ~]# yum install -y rsyslog

[root@rsyslog-server ~]# rsyslogd -v    # 查看版本
rsyslogd 8.24.0-57.el7_9, compiled with:
    PLATFORM:                x86_64-redhat-linux-gnu
    PLATFORM (lsb_release -d):
    FEATURE_REGEXP:                Yes
    GSSAPI Kerberos 5 support:        Yes
    FEATURE_DEBUG (debug build, slow code):    No
    32bit Atomic operations supported:    Yes
    64bit Atomic operations supported:    Yes
    memory allocator:            system default
    Runtime Instrumentation (slow code):    No
    uuid support:                Yes
    Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.

[root@rsyslog-server ~]# rpm -qc rsyslog    # 相关配置文件
/etc/logrotate.d/syslog
/etc/rsyslog.conf
/etc/sysconfig/rsyslog

# rsyslog v5 configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES #### # 模块

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command) # 支持本地系统日志记录（例如通过logger命令）
$ModLoad imjournal # provides access to the systemd journal　　# 提供对systemd日志的访问
#$ModLoad imklog   # provides kernel logging support (previously done by rklogd) # 提供内核日志记录支持（以前由rklogd完成）
#$ModLoad immark  # provides --MARK-- message capability # 提供了--MARK--消息功能

# Provides UDP syslog reception # 提供UDP系统日志接收
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception # 提供TCP系统日志接收
#$ModLoad imtcp
#$InputTCPServerRun 514


#### GLOBAL DIRECTIVES #### # 全局设置

# Where to place auxiliary files ; 辅助文件路径
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format # 使用默认的时间戳格式
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required, # 文件同步功能默认是关闭的。这个功能通常不是必需的
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/ # 将所有配置文件包含在/etc/rsyslog.d/中
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;　　# 关闭本地日志消息，使用imjournal
# local messages are retrieved through imjournal now.
$OmitLocalLogging on
# File to store the position in the journal # 存放日志文件位置
$IMJournalStateFile imjournal.state


#### RULES #### # 规则

# Log all kernel messages to the console. # 将所有内核消息记录到控制台 
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher. # 记录级别信息或更高级别的任何信息（邮件除外）
# Don‘t log private authentication messages! # 不要记录私人认证信息！
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
# 记录info级别的日志信息 排除mail authpriv cron
# The authpriv file has restricted access. # authpriv文件具有受限制的访问权限。
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place. # 将所有的邮件记录在一个地方。
mail.*                                                  -/var/log/maillog
# -/var/log/maillog 前面"-"是：代表异步写入,邮件量大占I/O在系统不忙时做

# Log cron stuff # 日志计划任务的东西
cron.*                                                  /var/log/cron

# Everybody gets emergency messages # 每用户都得到紧急消息
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.　　# 保存级别更高的错误信息的文件
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log  # 将启动信息保存到boot.log 只记录当前系统启动日志
local7.*                                                /var/log/boot.log


# ### begin forwarding rule ### # 开始转发规则
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$WorkDirectory /var/lib/rsyslog # where to place spool files
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# ### end of the forwarding rule ### 转发规则结束

配置文件/etc/rsyslog.conf主要有3个部分
MODULES ：模块
GLOBAL DRICTIVES :全局设置
RULES：规则