版本查看
$rsyslogd -version
rsyslogd 3.22.1, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: Yes
FEATURE_NETZIP (message compression): Yes
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
Atomic operations supported: Yes
Runtime Instrumentation (slow code): NoSee http://www.rsyslog.com for more information.安装
yum -y rsyslog#查看是否安装了rsyslogrpm -qa | grep rsyslog#如果还需要别的组件(mysql模块,日志轮转)yum -y rsyslog-mysql
yum -y logrotate启动/停止
/etc/init.d/rsyslog start/etc/init.d/rsyslog stop/etc/init.d/rsyslog restart
//帮助文档 man rsyslogd, 或者输入一个错误的命令
$rsyslogd --helprsyslogd: invalid option -- '-'usage: rsyslogd [-c] [-46AdnqQvwx] [-l] [-s]
[-f] [-i] [-N] [-M]
[-u]To run rsyslogd in native mode, use "rsyslogd -c3 "For further information see http://www.rsyslog.com/doc配置
rsyslog的配置文件有多种书写方法:
sysklogd(一些结构不兼容新特性),
legacy rsyslog(以“\$”开头的写法,如:$ModLoad imtcp.so),
RainerScript(一种新的格式,是最推荐使用的一种,尤其是需要做复杂的配置时)。
在本文中的配置都比较简单,就采用了legacy rsyslog的配置书写方法。更多详情参考:http://www.rsyslog.com/doc/master/configuration/basic_structure.html#statement-types 配置文件简单实例
下面是一个例子:
$less /etc/rsyslog.conf
#rsyslog v3 config file# if you experience problems, check# http://www.rsyslog.com/troubleshoot for assistance#### MODULES ####$ModLoad imuxsock.so # provides support for local system logging (e.g. via logger command)$ModLoad imklog.so # provides kernel logging support (previously done by rklogd)#$ModLoad immark.so # provides --MARK-- message capability# Provides UDP syslog reception#$ModLoad imudp.so#$UDPServerRun 514# Provides TCP syslog reception#$ModLoad imtcp.so #$InputTCPServerRun 514#### GLOBAL DIRECTIVES ##### Use default timestamp format$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat# File syncing capability is disabled by default. This feature is usually not required, # not useful and an extreme performance hit#$ActionFileEnableSync on#### RULES ##### Log all kernel messages to the console.# Logging much else clutters up the screen.#kern.* /dev/console# Log anything (except mail) of level info or higher.# Don't log private authentication messages!*.info;mail.none;authpriv.none;cron.none /var/log/messages# The authpriv file has restricted access.authpriv.* /var/log/secure# Log all the mail messages in one place.mail.* -/var/log/maillog# Log cron stuffcron.* /var/log/cron# Everybody gets emergency messages*.emerg *# Save news errors of level crit and higher in a special file.uucp,news.crit /var/log/spooler# Save boot messages also to boot.loglocal7.* /var/log/boot.log配置文件模块
配置文件查看less /etc/rsyslog.conf。Rsyslog的配置主要有以下模块:
modules,模块,配置加载的模块,如:ModLoad imudp.so配置加载UDP传输模块
global directives,全局配置,配置ryslog守护进程的全局属性,比如主信息队列大小(MainMessageQueueSize)