Some log files are controlled by a daemon called rsyslogd.
Log files can also be managed by the journald daemon – a component of systemd.
Step1: Centos6.5最小化安装后默认使用的是5.X的版本，
为了安装最新版，下载rsyslog官方源http://rpms.adiscon.com/v8-stable/rsyslog.repo到系统/etc/yum.repo.d/
[root@192_168_174_68 ~]# yum info rsyslog
Available Packages
Name : rsyslog
Arch : x86_64
Version : 5.8.10
Release : 10.el6_6
Size : 650 k
Repo : base
Summary : Enhanced system logging and kernel message trapping daemons
URL : http://www.rsyslog.com/
License : (GPLv3+ and ASL 2.0)
Description : Rsyslog is an enhanced, multi-threaded syslog daemon. It supports MySQL,
: syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part,
: and fine grain output format control. It is compatible with stock sysklogd
: and can be used as a drop-in replacement. Rsyslog is simple to set up, with
: advanced features suitable for enterprise-class, encryption-protected syslog
: relay chains.
Step2.下载官方最新的源仓库
[root@192_168_174_68 ~]# wget http://rpms.adiscon.com/v8-stable/rsyslog.repo -O /etc/yum.repos.d/rsyslog.repo
2016-02-26 11:35:45 (29.7 MB/s) - “/etc/yum.repos.d/rsyslog.repo” saved [227/227]
[root@192_168_174_68 ~]# cat /etc/yum.repos.d/rsyslog.repo
[rsyslog_v8]
name=Adiscon CentOS-$releasever - local packages for $basearch
baseurl=http://rpms.adiscon.com/v8-stable/epel-$releasever/$basearch
enabled=1
gpgcheck=0
gpgkey=http://rpms.adiscon.com/RPM-GPG-KEY-Adiscon
protect=1
Step3.安装rsyslog软件。
[root@192_168_174_68 ~]# yum install rsyslog
Step4.备份原配置文件，并修改配置文件
[root@192_168_174_68 ~]# cp -pv /etc/rsyslog.conf{,.orig}
`/etc/rsyslog.conf' -> `/etc/rsyslog.conf.orig'
[root@192_168_174_68 ~]# vim /etc/rsyslog.conf
确认已经开启下面2行，一个是unixsock日志，一个是内核日志。
#### MODULES ####
module(load="imuxsock") # provides support for local system logging (e.g. via logger command)
module(load="imklog") # provides kernel logging support (previously done by rklogd)
# Everybody gets emergency messages
*.emerg :omusrmsg:*
#开启udp支持。
module(load="imudp") # needs to be done just once
input(type="imudp" port="514")
#在配置文件的末尾添加自定义模板
$template TmplAuth, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"
$template TmplMsg, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"
authpriv.* ?TmplAuth
*.info,mail.none,authpriv.none,cron.none ?TmplMsg
最终的配置文件如下：
[root@192_168_174_68 ~]# grep -E -v '^#|^$' /etc/rsyslog.conf
module(load="imuxsock") # provides support for local system logging (e.g. via logger command)
module(load="imklog") # provides kernel logging support (previously done by rklogd)
module(load="imudp") # needs to be done just once
input(type="imudp" port="514")
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* /var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
$template TmplAuth, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"
$template TmplMsg, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log"
authpriv.* ?TmplAuth
*.info,mail.none,authpriv.none,cron.none ?TmplMsg
step5添加SYSLOGD_OPTIONS=""到/etc/sysconfig/rsyslog
[root@192_168_174_68 ~]# cat /etc/sysconfig/rsyslog
# Options for rsyslogd
# Syslogd options are deprecated since rsyslog v3.
# If you want to use them, switch to compatibility mode 2 by "-c 2"
# See rsyslogd(8) for more details
SYSLOGD_OPTIONS=""
step6启动服务
[root@192_168_174_68 ~]# /etc/init.d/rsyslog start
Starting system logger:
step7创建日志目录
[root@192_168_174_68 ~]# mkdir -p /var/log/rsyslog_custom
关于SELINUX的一些说明
Set SELINUX rules for rsyslog
Some system admin, disable the selinux .
If you want to keep SELINUX enable. Use the below given command
(Read this post,in case semanage command not found)
semanage fcontext -a -t syslogd_exec_t /sbin/rsyslogd
restorecon /sbin/rsyslogd
/usr/sbin/semanage fcontext -a -t var_log_t "/var/log/rsyslog_custom(/.*)?"
/sbin/restorecon -R -v /var/log/rsyslog_custom
step8:查看商品监听状态
[root@192_168_174_68 ~]# netstat -naup |grep rsyslogd
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
udp 0 0 0.0.0.0:514 0.0.0.0:* 1039/rsyslogd
udp 0 0 :::514 :::* 1039/rsyslogd
客户端：
step1安装软件仓库
[root@S192-168-175-40 ~]# wget http://rpms.adiscon.com/v8-stable/rsyslog.repo -O /etc/yum.repos.d/rsyslog.repo
step2.安装软件
[root@S192-168-175-40 ~]# yum install rsyslog
step3添加服务器ip
[root@S192-168-175-40 ~]# vim /etc/rsyslog.conf
添加
*.* @192.168.174.68:514
step4.启动服务
[root@S192-168-175-40 ~]# /etc/init.d/rsyslog restart
Shutting down system logger: [FAILED]
Starting system logger: [ OK ]
step5.去服务器上对比客户端的/var/log/messages的日志与服务器上的是否一致。
[root@192_168_174_68 rsyslog_custom]# pwd
/var/log/rsyslog_custom
[root@192_168_174_68 rsyslog_custom]# ll
total 8
drwx------ 2 root root 4096 Feb 26 13:27 192_168_174_68
drwx------ 2 root root 4096 Feb 26 13:34 S192-168-175-40
[root@192_168_174_68 S192-168-175-40]# ll
total 32
-rw------- 1 root root 2028 Feb 26 13:34 kernel.log
-rw------- 1 root root 0 Feb 26 13:34 rsyslogd.log
-rw------- 1 root root 20135 Feb 26 13:40 snmpd.log
-rw------- 1 root root 81 Feb 26 13:37 sshd.log
-rw------- 1 root root 728 Feb 26 13:39 xinetd.log
