ubuntu18.04部署syslog服务器-陌上烟雨遥

1、前提环境

服务端：Ubuntu18.04
客户端：linux系统开发板
保证服务端、客户端在在同一局域网内

2、日志等级

emerg，panic(紧急)：0级 – 这是最低的日志级别，系统无法使用。
警报(警报)：1级 – 必须立即采取行动。
错误(错误)：3级 – 危急情况。
警告(警告)：等级4 – 警告条件。
通知(通知)：第5级 – 正常但重要的条件。
info(信息)：6级 – 信息性消息。
debug(Debugging)：Level 7 – 这是最高级别 – 调试级别的消息。

3、配置


<span class="token function">sudo</span> <span class="token function">apt-get</span> <span class="token function">install</span> rsyslog 
<span class="token function">sudo</span> <span class="token function">apt-get</span> <span class="token function">install</span> rsyslog 
sudo apt-get install rsyslog


<span class="token function">sudo</span> <span class="token function">service</span> rsyslog status 
<span class="token function">sudo</span> <span class="token function">service</span> rsyslog status 
sudo service rsyslog status


<span class="token function">sudo</span> <span class="token function">vim</span> /etc/rsyslog.conf 
<span class="token function">sudo</span> <span class="token function">vim</span> /etc/rsyslog.conf 
sudo vim /etc/rsyslog.conf


 module<span class="token punctuation">(</span>load<span class="token operator">=</span><span class="token string">"imudp"</span><span class="token punctuation">)</span> input<span class="token punctuation">(</span>type<span class="token operator">=</span><span class="token string">"imudp"</span> <span class="token assign-left variable">port</span><span class="token operator">=</span><span class="token string">"514"</span><span class="token punctuation">)</span>  module<span class="token punctuation">(</span>load<span class="token operator">=</span><span class="token string">"imtcp"</span><span class="token punctuation">)</span> input<span class="token punctuation">(</span>type<span class="token operator">=</span><span class="token string">"imtcp"</span> <span class="token assign-left variable">port</span><span class="token operator">=</span><span class="token string">"514"</span><span class="token punctuation">)</span> 
 module<span class="token punctuation">(</span>load<span class="token operator">=</span><span class="token string">"imudp"</span><span class="token punctuation">)</span> input<span class="token punctuation">(</span>type<span class="token operator">=</span><span class="token string">"imudp"</span> <span class="token assign-left variable">port</span><span class="token operator">=</span><span class="token string">"514"</span><span class="token punctuation">)</span>  module<span class="token punctuation">(</span>load<span class="token operator">=</span><span class="token string">"imtcp"</span><span class="token punctuation">)</span> input<span class="token punctuation">(</span>type<span class="token operator">=</span><span class="token string">"imtcp"</span> <span class="token assign-left variable">port</span><span class="token operator">=</span><span class="token string">"514"</span><span class="token punctuation">)</span> 
 module(load="imudp") input(type="imudp" port="514")  module(load="imtcp") input(type="imtcp" port="514")

如果你想限制访问特定子网，IP或域，请添加如下：


<span class="token variable">$AllowedSender</span> TCP, <span class="token number">127.0</span>.0.1, <span class="token number">192.168</span>.10.0/24, *.example.com 
<span class="token variable">$AllowedSender</span> TCP, <span class="token number">127.0</span>.0.1, <span class="token number">192.168</span>.10.0/24, *.example.com 
$AllowedSender TCP, 127.0.0.1, 192.168.10.0/24, *.example.com

可以在输入input(type=“imtcp” port=“514”)行后添加上面的行，请记住用正确的值替换给定的值。

让我们创建一个模板，指示rsyslog服务器如何存储传入的syslog消息，在GLOBAL DIRECTIVES部分之前添加模板


<span class="token variable">$template</span> RemoteLogs,<span class="token string">"/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log"</span> *.* ?RemoteLogs <span class="token operator">&</span> stop 
<span class="token variable">$template</span> RemoteLogs,<span class="token string">"/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log"</span> *.* ?RemoteLogs <span class="token operator">&</span> stop 
$template RemoteLogs,"/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log" *.* ?RemoteLogs & stop

收到的日志将使用上面的模板进行解析并存储在目录/var/log/remote中，文件命名遵循约定：%HOSTNAME% and %PROGRAMNAME%变量，即:客户端主机名和生成日志消息的客户端工具。
& stop指示rsyslog守护程序仅将日志消息存储到指定的文件（也有人使用& ~）。
可以使用的其它变量包括：
%syslogseverity%, %syslogfacility%, %timegenerated%, %HOSTNAME%, %syslogtag%, %msg%, %FROMHOST-IP%, %PRI%, %MSGID%, %APP-NAME%, %TIMESTAMP%, % $y e a r$ month%, %$day%


         module<span class="token punctuation">(</span>load<span class="token operator">=</span><span class="token string">"imuxsock"</span><span class="token punctuation">)</span>    module<span class="token punctuation">(</span>load<span class="token operator">=</span><span class="token string">"imudp"</span><span class="token punctuation">)</span> input<span class="token punctuation">(</span>type<span class="token operator">=</span><span class="token string">"imudp"</span> <span class="token assign-left variable">port</span><span class="token operator">=</span><span class="token string">"514"</span><span class="token punctuation">)</span>     module<span class="token punctuation">(</span>load<span class="token operator">=</span><span class="token string">"imklog"</span> <span class="token assign-left variable">permitnonkernelfacility</span><span class="token operator">=</span><span class="token string">"on"</span><span class="token punctuation">)</span> <span class="token variable">$template</span> RemoteLogs,<span class="token string">"/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log"</span> *.* ?RemoteLogs <span class="token operator">&</span> stop        <span class="token variable">$ActionFileDefaultTemplate</span> RSYSLOG_TraditionalFileFormat  <span class="token variable">$RepeatedMsgReduction</span> on    <span class="token variable">$FileOwner</span> syslog <span class="token variable">$FileGroup</span> adm <span class="token variable">$FileCreateMode</span> 0640 <span class="token variable">$DirCreateMode</span> 0755 <span class="token variable">$Umask</span> 0022 <span class="token variable">$PrivDropToUser</span> syslog <span class="token variable">$PrivDropToGroup</span> syslog    <span class="token variable">$WorkDirectory</span> /var/spool/rsyslog    <span class="token variable">$IncludeConfig</span> /etc/rsyslog.d/*.conf 
         module<span class="token punctuation">(</span>load<span class="token operator">=</span><span class="token string">"imuxsock"</span><span class="token punctuation">)</span>    module<span class="token punctuation">(</span>load<span class="token operator">=</span><span class="token string">"imudp"</span><span class="token punctuation">)</span> input<span class="token punctuation">(</span>type<span class="token operator">=</span><span class="token string">"imudp"</span> <span class="token assign-left variable">port</span><span class="token operator">=</span><span class="token string">"514"</span><span class="token punctuation">)</span>     module<span class="token punctuation">(</span>load<span class="token operator">=</span><span class="token string">"imklog"</span> <span class="token assign-left variable">permitnonkernelfacility</span><span class="token operator">=</span><span class="token string">"on"</span><span class="token punctuation">)</span> <span class="token variable">$template</span> RemoteLogs,<span class="token string">"/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log"</span> *.* ?RemoteLogs <span class="token operator">&</span> stop        <span class="token variable">$ActionFileDefaultTemplate</span> RSYSLOG_TraditionalFileFormat  <span class="token variable">$RepeatedMsgReduction</span> on    <span class="token variable">$FileOwner</span> syslog <span class="token variable">$FileGroup</span> adm <span class="token variable">$FileCreateMode</span> 0640 <span class="token variable">$DirCreateMode</span> 0755 <span class="token variable">$Umask</span> 0022 <span class="token variable">$PrivDropToUser</span> syslog <span class="token variable">$PrivDropToGroup</span> syslog    <span class="token variable">$WorkDirectory</span> /var/spool/rsyslog    <span class="token variable">$IncludeConfig</span> /etc/rsyslog.d/*.conf 
         module(load="imuxsock")    module(load="imudp") input(type="imudp" port="514")     module(load="imklog" permitnonkernelfacility="on") $template RemoteLogs,"/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log" *.* ?RemoteLogs & stop        $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat  $RepeatedMsgReduction on    $FileOwner syslog $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 $PrivDropToUser syslog $PrivDropToGroup syslog    $WorkDirectory /var/spool/rsyslog    $IncludeConfig /etc/rsyslog.d/*.conf


<span class="token function">sudo</span> systemtcl restart rsyslog 
<span class="token function">sudo</span> systemtcl restart rsyslog 
sudo systemtcl restart rsyslog


ss <span class="token parameter variable">-tunelp</span> <span class="token operator">|</span> <span class="token function">grep</span> <span class="token number">514</span> 
ss <span class="token parameter variable">-tunelp</span> <span class="token operator">|</span> <span class="token function">grep</span> <span class="token number">514</span> 
ss -tunelp | grep 514


<span class="token function">nc</span> <span class="token parameter variable">-vuz</span> <span class="token number">192.168</span>.3.99 <span class="token number">514</span> 
<span class="token function">nc</span> <span class="token parameter variable">-vuz</span> <span class="token number">192.168</span>.3.99 <span class="token number">514</span> 
nc -vuz 192.168.3.99 514

如果你的ufw防火墙服务正在运行，请允许rsyslog防火墙端口：


<span class="token function">sudo</span> ufw allow <span class="token number">514</span>/tcp <span class="token function">sudo</span> ufw allow <span class="token number">514</span>/udp 
<span class="token function">sudo</span> ufw allow <span class="token number">514</span>/tcp <span class="token function">sudo</span> ufw allow <span class="token number">514</span>/udp 
sudo ufw allow 514/tcp sudo ufw allow 514/udp

4、将Rsyslog配置为客户端（我没使用此配置，用的是脚本）


<span class="token function">sudo</span> <span class="token function">vim</span> /etc/rsyslog.conf 
<span class="token function">sudo</span> <span class="token function">vim</span> /etc/rsyslog.conf 
sudo vim /etc/rsyslog.conf


<span class="token variable">$PreserveFQDN</span> on 
<span class="token variable">$PreserveFQDN</span> on 
$PreserveFQDN on


*.* @ip-address-of-rsysog-server:514 
*.* @ip-address-of-rsysog-server:514 
*.* @ip-address-of-rsysog-server:514

还可以使用FQDN而不是服务器IP地址：


*.* @fqdn-of-rsysog-server:514 
*.* @fqdn-of-rsysog-server:514 
*.* @fqdn-of-rsysog-server:514

以上行将允许通过UDP发送日志，因为tcp使用@@而不是单个@：


*.* @@ip-address-of-rsysog-server:514 
*.* @@ip-address-of-rsysog-server:514 
*.* @@ip-address-of-rsysog-server:514

或者：


*.* @@fqdn-of-rsysog-server:514 
*.* @@fqdn-of-rsysog-server:514 
*.* @@fqdn-of-rsysog-server:514


<span class="token variable">$ActionQueueFileName</span> queue <span class="token variable">$ActionQueueMaxDiskSpace</span> 1g <span class="token variable">$ActionQueueSaveOnShutdown</span> on <span class="token variable">$ActionQueueType</span> LinkedList <span class="token variable">$ActionResumeRetryCount</span> <span class="token parameter variable">-1</span> 
<span class="token variable">$ActionQueueFileName</span> queue <span class="token variable">$ActionQueueMaxDiskSpace</span> 1g <span class="token variable">$ActionQueueSaveOnShutdown</span> on <span class="token variable">$ActionQueueType</span> LinkedList <span class="token variable">$ActionResumeRetryCount</span> <span class="token parameter variable">-1</span> 
$ActionQueueFileName queue $ActionQueueMaxDiskSpace 1g $ActionQueueSaveOnShutdown on $ActionQueueType LinkedList $ActionResumeRetryCount -1


<span class="token function">sudo</span> <span class="token function">service</span> rsyslog restart 
<span class="token function">sudo</span> <span class="token function">service</span> rsyslog restart 
sudo service rsyslog restart