集中日志服务器Rsyslog

浅浅的花香味﹌ 2022-07-10 13:28 209阅读 0赞

分布式集群服务器日志集中方案

安装：

cd /usr/local/rsyslog/
    wget http://rpms.adiscon.com/v8-stable/rsyslog.repo
    yum install rsyslog

打开服务：

service rsyslog start

修改文件 /etc/sysconfig/rsyslog

添加：

SYSLOGD\_OPTIONS=-m 0 -r”

配置：etc/rsyslog.conf

# rsyslog configuration file
    
    # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
    # If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html
    
    #### MODULES ####
    
    # The imjournal module bellow is now used as a message source instead of imuxsock.
    $ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
    $ModLoad imjournal # provides access to the systemd journal
    #$ModLoad imklog # reads kernel messages (the same are read from journald)
    #$ModLoad immark  # provides --MARK-- message capability
    
    # Provides UDP syslog reception
    $ModLoad imudp
    $UDPServerRun 514
    
    # Provides TCP syslog reception
    $ModLoad imtcp
    $InputTCPServerRun 514
    
    
    #### GLOBAL DIRECTIVES ####
    
    # Where to place auxiliary files
    $WorkDirectory /var/lib/rsyslog
    
    # Use default timestamp format
    $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
    
    # File syncing capability is disabled by default. This feature is usually not required,
    # not useful and an extreme performance hit
    #$ActionFileEnableSync on
    
    # Include all config files in /etc/rsyslog.d/
    $IncludeConfig /etc/rsyslog.d/*.conf
    
    # Turn off message reception via local log socket;
    # local messages are retrieved through imjournal now.
    $OmitLocalLogging on
    
    # File to store the position in the journal
    $IMJournalStateFile imjournal.state
    
    
    #### RULES ####
    
    # Log all kernel messages to the console.
    # Logging much else clutters up the screen.
    #kern.*                                                 /dev/console
    
    # Log anything (except mail) of level info or higher.
    # Don't log private authentication messages!
    *.info;mail.none;authpriv.none;cron.none                /var/log/messages
    
    # The authpriv file has restricted access.
    authpriv.*                                              /var/log/secure
    
    # Log all the mail messages in one place.
    mail.*                                                  -/var/log/maillog
    
    
    # Log cron stuff
    cron.*                                                  /var/log/cron
    
    # Everybody gets emergency messages
    *.emerg                                                 :omusrmsg:*
    
    # Save news errors of level crit and higher in a special file.
    uucp,news.crit                                          /var/log/spooler
    
    # Save boot messages also to boot.log
    local7.*                                                /var/log/boot.log
    
    local2.*						/var/log/local2.log			
    
    
    # ### begin forwarding rule ###
    # The statement between the begin ... end define a SINGLE forwarding
    # rule. They belong together, do NOT split them. If you create multiple
    # forwarding rules, duplicate the whole block!
    # Remote Logging (we use TCP for reliable delivery)
    #
    # An on-disk queue is created for this action. If the remote host is
    # down, messages are spooled to disk and sent when it is up again.
    #$ActionQueueFileName fwdRule1 # unique name prefix for spool files
    #$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
    #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
    #$ActionQueueType LinkedList   # run asynchronously
    #$ActionResumeRetryCount -1    # infinite retries if host is down
    # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
    *.* @@remote-host:514
    # ### end of the forwarding rule ###

重启： service rsyslog start

java中log4将配置：

######################################  
    #         log4j配置相关说明  
    ######################################  
      
    #%p 输出优先级，即DEBUG，INFO，WARN，ERROR，FATAL   
    #%r 输出自应用启动到输出该log信息耗费的毫秒数   
    #%c 输出所属的类目，通常就是所在类的全名   
    #%t 输出产生该日志事件的线程名  
    #%m 输出代码中指定的信息   
    #%n 输出一个回车换行符，Windows平台为“\r\n”，Unix平台为“\n”   
    #%d 输出日志时间点的日期或时间，默认格式为ISO8601，也可以在其后指定格式，比如：%d{yyyy MM dd HH:mm:ss,SSS}，输出类似： 2002年10月18日 22：10：28，921   
    #%l 输出日志事件的发生位置，包括类目名、发生的线程，以及在代码中的行数。举例：Testlog4.main(TestLog4.java:10)   
      
    #log4j提供4种布局:   
    #org.apache.log4j.HTMLLayout（以HTML表格形式布局）  
    #org.apache.log4j.PatternLayout（可以灵活地指定布局模式），  
    #org.apache.log4j.SimpleLayout（包含日志信息的级别和信息字符串），  
    #org.apache.log4j.TTCCLayout（包含日志产生的时间、线程、类别等等信息  
      
    #log4j中有五级logger 输出级别:  
    #FATAL 0   
    #ERROR 3   
    #WARN 4   
    #INFO 6   
    #DEBUG 7  
      
    ######################################  
    #          log4j相关配置  
    ######################################  
      
    #日志输出级别  
    log4j.rootLogger=INFO,stdout,other,SYSLOG  
      
    #设置stdout的日志输出控制台  
    log4j.appender.stdout=org.apache.log4j.ConsoleAppender  
    #输出日志到控制台的方式，默认为System.out  
    log4j.appender.stdout.Target = System.out  
    #设置使用灵活布局  
    log4j.appender.stdout.layout=org.apache.log4j.PatternLayout  
    #灵活定义输出格式  
    log4j.appender.stdout.layout.ConversionPattern=[%p][%d{yyyy-MM-dd HH:mm:ss}] %l %m %n    
      
    #设置other的日志输出控制台  
    log4j.appender.other=org.apache.log4j.RollingFileAppender  
    #设置other的输出日志  
    log4j.appender.other.File=C://test/logs/log.log  
    #设置other的日志最大限制  
    log4j.appender.other.MaxFileSize=1024KB  
    #最多只保存20个备份文件  
    log4j.appender.other.MaxBackupIndex=1000  
    #输出INFO级别以上的日志  
    og4j.appender.other.Threshold=INFO   
    #设置使用灵活布局  
    log4j.appender.other.layout=org.apache.log4j.PatternLayout  
    #灵活定义输出格式  
    log4j.appender.other.layout.ConversionPattern=[%p][%d{yyyy-MM-dd HH:mm:ss}] %l %t %m %n
    
    
    #设置SYSLOG的日志输出远程
    log4j.appender.SYSLOG=org.apache.log4j.net.SyslogAppender
    log4j.appender.SYSLOG.syslogHost= 192.168.21.130
    log4j.appender.SYSLOG.facility=local2
    log4j.appender.SYSLOG.facilityPrinting=true
    ##log4j.appender.SYSLOG.Header=true  #打印日志信息时前面带上应用程序所在服务器的信息  
    log4j.appender.SYSLOG.layout=org.apache.log4j.PatternLayout
    log4j.appender.SYSLOG.layout.ConversionPattern=%d{dd-MM-yyyy HH:mm:ss}  %-5p (%C:%M:%L) - %m%n

测试：

package yyf.org.slf4j.log;
    
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    
    public class Test {
    	private final static Logger LOG = LoggerFactory.getLogger(Test.class.getClass());
    
    	public static void main(String[] args) throws InterruptedException {
    		while(true){
    			LOG.info("##test 你"+System.currentTimeMillis());
    			LOG.error("##test 好"+System.currentTimeMillis());
    			Thread.sleep(1000);
    		}
    	}
    }

console:

[ERROR][2017-02-17 11:53:55] yyf.org.slf4j.log.Test.main(Test.java:12) ##test 好1487303635641 
        [INFO][2017-02-17 11:53:56] yyf.org.slf4j.log.Test.main(Test.java:11) ##test 你1487303636641 
        [ERROR][2017-02-17 11:53:56] yyf.org.slf4j.log.Test.main(Test.java:12) ##test 好1487303636641 
        [INFO][2017-02-17 11:53:57] yyf.org.slf4j.log.Test.main(Test.java:11) ##test 你1487303637641 
        [ERROR][2017-02-17 11:53:57] yyf.org.slf4j.log.Test.main(Test.java:12) ##test 好1487303637641 
        [INFO][2017-02-17 11:53:58] yyf.org.slf4j.log.Test.main(Test.java:11) ##test 你1487303638642 
        [ERROR][2017-02-17 11:53:58] yyf.org.slf4j.log.Test.main(Test.java:12) ##test 好1487303638642

tail -f /var/log/local2.log

n:12) - ##test 好1487303617617#015#012    
    Dec  9 04:24:01 192.168.21.1 local2: 17-02-2017 11:53:38  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303618620#015#012    
    Dec  9 04:24:01 192.168.21.1 local2: 17-02-2017 11:53:38  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303618620#015#012    
    Dec  9 04:24:02 192.168.21.1 local2: 17-02-2017 11:53:39  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303619621#015#012    
    Dec  9 04:24:02 192.168.21.1 local2: 17-02-2017 11:53:39  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303619621#015#012    
    Dec  9 04:24:03 192.168.21.1 local2: 17-02-2017 11:53:40  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303620623#015#012    
    Dec  9 04:24:03 192.168.21.1 local2: 17-02-2017 11:53:40  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303620623#015#012    
    Dec  9 04:24:04 192.168.21.1 local2: 17-02-2017 11:53:41  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303621624#015#012    
    Dec  9 04:24:04 192.168.21.1 local2: 17-02-2017 11:53:41  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303621624#015#012    
    Dec  9 04:24:05 192.168.21.1 local2: 17-02-2017 11:53:42  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303622624#015#012    
    Dec  9 04:24:05 192.168.21.1 local2: 17-02-2017 11:53:42  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303622624#015#012    
    Dec  9 04:24:06 192.168.21.1 local2: 17-02-2017 11:53:43  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303623625#015#012    
    Dec  9 04:24:06 192.168.21.1 local2: 17-02-2017 11:53:43  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303623627#015#012    
    Dec  9 04:24:07 192.168.21.1 local2: 17-02-2017 11:53:44  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303624628#015#012    
    Dec  9 04:24:07 192.168.21.1 local2: 17-02-2017 11:53:44  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303624628#015#012    
    Dec  9 04:24:08 192.168.21.1 local2: 17-02-2017 11:53:45  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303625629#015#012    
    Dec  9 04:24:08 192.168.21.1 local2: 17-02-2017 11:53:45  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303625629#015#012    
    Dec  9 04:24:09 192.168.21.1 local2: 17-02-2017 11:53:46  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303626630#015#012    
    Dec  9 04:24:09 192.168.21.1 local2: 17-02-2017 11:53:46  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303626630#015#012    
    Dec  9 04:24:10 192.168.21.1 local2: 17-02-2017 11:53:47  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303627631#015#012    
    Dec  9 04:24:10 192.168.21.1 local2: 17-02-2017 11:53:47  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303627631#015#012    
    Dec  9 04:24:11 192.168.21.1 local2: 17-02-2017 11:53:48  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303628632#015#012    
    Dec  9 04:24:11 192.168.21.1 local2: 17-02-2017 11:53:48  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303628632#015#012    
    Dec  9 04:24:12 192.168.21.1 local2: 17-02-2017 11:53:49  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303629633#015#012    
    Dec  9 04:24:12 192.168.21.1 local2: 17-02-2017 11:53:49  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303629633#015#012    
    Dec  9 04:24:13 192.168.21.1 local2: 17-02-2017 11:53:50  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303630634#015#012    
    Dec  9 04:24:13 192.168.21.1 local2: 17-02-2017 11:53:50  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303630634#015#012    
    Dec  9 04:24:14 192.168.21.1 local2: 17-02-2017 11:53:51  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303631635#015#012    
    Dec  9 04:24:14 192.168.21.1 local2: 17-02-2017 11:53:51  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303631635#015#012    
    Dec  9 04:24:15 192.168.21.1 local2: 17-02-2017 11:53:52  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303632636#015#012    
    Dec  9 04:24:15 192.168.21.1 local2: 17-02-2017 11:53:52  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303632637#015#012    
    Dec  9 04:24:16 192.168.21.1 local2: 17-02-2017 11:53:53  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303633637#015#012    
    Dec  9 04:24:16 192.168.21.1 local2: 17-02-2017 11:53:53  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303633637#015#012    
    Dec  9 04:24:17 192.168.21.1 local2: 17-02-2017 11:53:54  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303634638#015#012    
    Dec  9 04:24:17 192.168.21.1 local2: 17-02-2017 11:53:54  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303634638#015#012    
    Dec  9 04:24:18 192.168.21.1 local2: 17-02-2017 11:53:55  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303635640#015#012    
    Dec  9 04:24:18 192.168.21.1 local2: 17-02-2017 11:53:55  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303635641#015#012    
    Dec  9 04:24:19 192.168.21.1 local2: 17-02-2017 11:53:56  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303636641#015#012    
    Dec  9 04:24:19 192.168.21.1 local2: 17-02-2017 11:53:56  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303636641#015#012    
    Dec  9 04:24:20 192.168.21.1 local2: 17-02-2017 11:53:57  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303637641#015#012    
    Dec  9 04:24:20 192.168.21.1 local2: 17-02-2017 11:53:57  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303637641#015#012    
    Dec  9 04:24:21 192.168.21.1 local2: 17-02-2017 11:53:58  INFO  (yyf.org.slf4j.log.Test:main:11) - ##test 你1487303638642#015#012    
    Dec  9 04:24:21 192.168.21.1 local2: 17-02-2017 11:53:58  ERROR (yyf.org.slf4j.log.Test:main:12) - ##test 好1487303638642#015#012