當前位置：首頁 > 编程资源 > 编程问答 >内容正文

编程问答

Rsyslog 日志相关内容

發布時間：2023/12/13 编程问答 33 豆豆

生活随笔收集整理的這篇文章主要介紹了 Rsyslog 日志相关内容小編覺得挺不錯的,現在分享給大家,幫大家做個參考.

[root@server vusers_home]# rpm -ql rsyslog|more ? ? ? ###.so結尾為模塊，模塊有分im為輸入模塊，om 為輸出模塊
/etc/logrotate.d/syslog
/etc/pki/rsyslog
/etc/rc.d/init.d/rsyslog
/etc/rsyslog.conf
/etc/rsyslog.d
/etc/sysconfig/rsyslog
/lib64/rsyslog
/lib64/rsyslog/imfile.so
/lib64/rsyslog/imklog.so
/lib64/rsyslog/immark.so
/lib64/rsyslog/impstats.so
/lib64/rsyslog/imptcp.so
/lib64/rsyslog/imtcp.so
/lib64/rsyslog/imudp.so
/lib64/rsyslog/imuxsock.so
/lib64/rsyslog/lmnet.so
/lib64/rsyslog/lmnetstrms.so
/lib64/rsyslog/lmnsd_ptcp.so
/lib64/rsyslog/lmregexp.so
/lib64/rsyslog/lmstrmsrv.so
/lib64/rsyslog/lmtcpclt.so
/lib64/rsyslog/lmtcpsrv.so
/lib64/rsyslog/lmzlibw.so
/lib64/rsyslog/ommail.so
/lib64/rsyslog/omprog.so
/lib64/rsyslog/omruleset.so
/lib64/rsyslog/omtesting.so
/lib64/rsyslog/omuxsock.so
/lib64/rsyslog/pmlastmsg.so
/sbin/rsyslogd

......

主程序：rsyslogd
配置文件：/etc/rsyslog.conf
服務腳本：/etc/rc.d/init.d/rsyslog
/var/log/dmesg #是用來記錄系統啟動日志的

rsyslog.conf(配置文件)
RULES:
facility.priority target
日志收集方：
facility：設施，從功能或程序上對日志進行分類；
auth, authpriv, cron, daemon, kern, lpr, mail, mark, news, security, user, uucp, local0-local7, syslog
priority
debug, info, notice, warn(warning), err(error), crit(critical), alert, emerg(panic)
示例：
*.info;mail.none;authpriv.none;cron.none /var/log/messages

# The authpriv file has restricted access.
authpriv.* 　　　　　　　　　　　　　　　　 /var/log/secure

# Log all the mail messages in one place.
mail.*　　　　　　　　　　　　　　　　　　 -/var/log/maillog

# Log cron stuff
cron.* ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? /var/log/cron

# Everybody gets emergency messages
*.emerg　　　　　　　　　　　　　　　　　?*

# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler

# Save boot messages also to boot.log
local7.* 　　　　　　　　　　　　　　 /var/log/boot.log

指定級別：
*: 所有級別
none: 沒有級別
priority: 此級別及更高級別的日志信息
=priority：此級別

target:
文件路徑：記錄于指定的日志文件中，通常應該在/var/log目錄下；文件路徑前的“-”表示異步寫入；
用戶：將日志通知給指定用戶
*: 所有用戶
日志服務器：@host
host: 必須要監聽在tcp或udp協議514端口上提供服務；
管道： |COMMAND

測試實例：

ssh 服務單獨記錄一個日志文件：

[root@server vusers_home]# vim /etc/ssh/sshd_config?

# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#SyslogFacility AUTHPRIV
SyslogFacility local2 ? ? ? ? ? ?#將原有的換成local2

[root@server vusers_home]# service sshd reload
Reloading sshd: [ OK ]
[root@server vusers_home]# vim /etc/rsyslog.conf

# Save boot messages also to boot.log
local7.* ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? /var/log/boot.log
local2.* ? 　　　　　　　　　　　　　　　　 /var/log/sshd.log

[root@server vusers_home]# service rsyslog restart
Shutting down system logger: [ OK ]
Starting system logger: [ OK ]

在另外一個端口重新登錄并查看日志：
[root@server vusers_home]# cat /var/log/sshd.log
May 18 16:04:50 server sshd[5290]: reverse mapping checking getaddrinfo for bogon [192.168.244.2] failed - POSSIBLE BREAK-IN ATTEMPT!
May 18 16:04:50 server sshd[5290]: Accepted password for root from 192.168.244.2 port 62797 ssh2
[root@server vusers_home]# cat /var/log/sshd.log
May 18 16:04:50 server sshd[5290]: reverse mapping checking getaddrinfo for bogon [192.168.244.2] failed - POSSIBLE BREAK-IN ATTEMPT!
May 18 16:04:50 server sshd[5290]: Accepted password for root from 192.168.244.2 port 62797 ssh2

文件記錄的日志的格式：
事件產生的日期時間主機進程(pid)：事件內容

例：

May 18 16:02:27 server sshd[5239]: Server listening on :: port 22.

May 18 16:03:46 server kernel: Kernel logging (proc) stopped.

有些日志記錄二進制格式：/var/log/wtmp，/var/log/btmp
/var/log/wtmp: 當前系統上成功登錄的日志；
last

例子：

[root@server ~]# last
root pts/1 192.168.244.2 Thu May 18 16:04 still logged in
root pts/1 192.168.244.2 Thu May 18 16:04 - 16:04 (00:00)
root pts/0 192.168.244.2 Thu May 18 10:40 - 16:37 (05:56)
root pts/0 192.168.244.2 Wed May 17 11:43 - 10:39 (22:55)
root pts/1 192.168.244.2 Mon Jun 13 19:19 - 11:24 (337+16:05)
root pts/0 192.168.244.2 Mon Jun 13 18:57 - 11:24 (337+16:27)
root pts/1 192.168.244.2 Mon Jun 13 08:55 - 18:45 (09:50)
root pts/0 192.168.244.2 Mon Jun 13 03:59 - 10:45 (06:46)
reboot system boot 2.6.32-573.el6.x Mon Jun 13 03:58 - 16:37 (339+12:39)
root pts/1 192.168.244.2 Sun Jun 12 23:58 - down (03:59)
root pts/0 192.168.244.2 Sun Jun 12 23:39 - 01:52 (02:13)
root tty1 Sun Jun 12 23:28 - down (04:29)
reboot system boot 2.6.32-573.el6.x Sun Jun 12 23:27 - 03:57 (04:30)
root tty1 Sun Jun 12 23:26 - down (00:01)
reboot system boot 2.6.32-573.el6.x Sun Jun 12 23:25 - 23:27 (00:01)

/var/log/btmp：當前系統上失敗的登錄嘗試；
lastb

[root@server ~]# lastb
root ssh:notty 192.168.244.101 Thu May 18 16:33 - 16:33 (00:00)

lastlog命令：顯示當前系統每一個用戶最近一次的登錄時間；

例子：

[root@server ~]# lastlog
Username Port From Latest
root pts/0 192.168.244.2 Thu May 18 16:37:34 +0800 2017
bin **Never logged in**
daemon **Never logged in**

####日志服務器如何完成（也就是如何作為收集其他機器日志信息的日志服務器）#############

環境：日志服務器：192.168.244.100

? ? ? ? 被收集服務器：192.168.244.101

#要成為rsyslog只需打開監聽模塊即可

[root@192.168.244.100 ~]# vim /etc/rsyslog.conf ? #需要監聽514端口，用udp還是tcp可自選

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

[root@server ~]# netstat -lntup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 5407/rsyslogd
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 2785/mysqld
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 5112/vsftpd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 5239/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1389/master
tcp 0 0 :::514 :::* LISTEN 5407/rsyslogd
tcp 0 0 :::22 :::* LISTEN 5239/sshd
tcp 0 0 ::1:25 :::* LISTEN 1389/master
udp 0 0 0.0.0.0:514 0.0.0.0:* 5407/rsyslogd
udp 0 0 :::514 :::* 5407/rsyslogd

[root@192.168.244.101 ~]# vi /etc/rsyslog.conf

#*.info;mail.none;authpriv.none;cron.none ?/var/log/messages
*.info;mail.none;authpriv.none;cron.none ?@192.168.244.100 ? ?

[root@192.168.244.101 ~]# service rsyslog restart?

[root@192.168.244.101 ~]# yum install -y vsftpd?

在rsyslog服務器的/var/log/message上可以看到： ?

[root@192.168.244.100 ~]# tail -f /var/log/messages

May 18 05:19:29 localhost yum[5817]: Installed: vsftpd-3.0.2-21.el7.x86_64

注意點：如果有防火墻，需放行514端口

#####################如何讓rsyslog服務器將日志記錄到遠端mysql數據庫中#####################

環境：

mysql-server:192.168.244.101

rsyslog-server:192.168.244.100

[root@server ~]# ip addr|grep global
inet 192.168.244.100/24 brd 192.168.244.255 scope global eth0

[root@centos7 ~]# ip addr|grep inet|grep global
inet 192.168.244.101/24 brd 192.168.244.255 scope global eno16777736

[root@centos7 ~]# rpm -qa mariadb
mariadb-5.5.52-1.el7.x86_64

[root@centos7 ~]# ss -tnl|grep 3306
LISTEN 0 50 *:3306 *:*

[root@server src]# yum list all rsyslog* ? ?#查看相關包，最主要的需要rsyslog-mysql 這個程序包，連接mysql的驅動

rsyslog-mysql.x86_64 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 5.8.10-10.el6_6 ? ? ? ? ? ? ? ? ? ? ? ? ?base?

[root@server ~]# yum install -y rsyslog-mysql

[root@server ~]# rpm -ql rsyslog-mysql
/lib64/rsyslog/ommysql.so ? ? ? ? ? ? #模塊
/usr/share/doc/rsyslog-mysql-5.8.10
/usr/share/doc/rsyslog-mysql-5.8.10/createDB.sql ? ?#mysql命令包，需要在mysql中運行

[root@centos7 ~]# mysql ? ? ? ?#登陸mysql-server 為sysloguser 這個用戶授權
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 5
Server version: 5.5.52-MariaDB MariaDB Server

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> grant all on Syslog.* to 'sysloguser'@'192.168.%.%' identified by 'syslogpass';

[root@centos7 ~]# vim /etc/my.cnf ?#增加如下兩行
[mysqld]

skip_name_resolve = on
innodb_file_per_table = on

[root@centos7 ~]# systemctl restart mariadb.service ?#重啟mysql-server

[root@server ~]# mysql -usysloguser -h192.168.244.101 -p ? ?#在rsyslog服務器連接測試mysql-server中新建的用戶可連接性
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.5.52-MariaDB MariaDB Server

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>

接下來導入下面的sql 包：

[root@server ~]# mysql -usysloguser -h192.168.244.101 -p < /usr/share/doc/rsyslog-mysql-5.8.10/createDB.sql ??

[root@server ~]# mysql -usysloguser -h192.168.244.101 -p ? ? #登陸mysql-server 查看操作是否成功，Syslog庫是否建立
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 5
Server version: 5.5.52-MariaDB MariaDB Server

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>

##################接下里配置rsyslog服務器能使用mysql###################

[root@server ~]# vim /etc/rsyslog.conf ? ? #編輯文件，在MODULES 里，增加一行

#### MODULES ####

$ModLoad ommysql

#### RULES ####

#*.info;mail.none;authpriv.none;cron.none ? ? ? ? ? ? ? ?/var/log/messages

*.info;mail.none;authpriv.none;cron.none ? ? ? ? ?:ommysql:192.168.244.101,Syslog,sysloguser,syslogpass

注釋：:ommysql:192.168.244.101,Syslog,sysloguser,syslogpass ??

?輸出到mysql模塊：mysql地址，數據庫名，數據庫登陸名，數據庫登陸密碼

[root@server ~]# /etc/init.d/rsyslog restart ? ?#重啟rsyslog

[root@server ~]# yum install -y zile ??

[root@centos7 ~]# mysql ? ?#mysql-server #查看安裝zile是否有記錄

MariaDB [Syslog]> select count(*) from SystemEvents;

+----------+
| count(*) |
+----------+
| 4 |
+----------+
1 row in set (0.01 sec)

MariaDB [Syslog]> select count(*) from SystemEventsProperties;
+----------+
| count(*) |
+----------+
| 0 |
+----------+
1 row in set (0.00 sec)

MariaDB [Syslog]> select * from SystemEvents\G;
*************************** 1. row ***************************
ID: 1
CustomerID: NULL
ReceivedAt: 2017-05-18 18:25:57
DeviceReportedTime: 2017-05-18 18:25:57
Facility: 0
Priority: 6
FromHost: server
Message: imklog 5.8.10, log source = /proc/kmsg started.
NTSeverity: NULL
Importance: NULL
EventSource: NULL
EventUser: NULL
EventCategory: NULL
EventID: NULL
EventBinaryData: NULL
MaxAvailable: NULL
CurrUsage: NULL
MinUsage: NULL
MaxUsage: NULL
InfoUnitID: 1
SysLogTag: kernel:
EventLogType: NULL
GenericFileName: NULL
SystemID: NULL
*************************** 2. row ***************************
ID: 2
CustomerID: NULL
ReceivedAt: 2017-05-18 18:25:57
DeviceReportedTime: 2017-05-18 18:25:57
Facility: 5
Priority: 6
FromHost: server
Message: [origin software="rsyslogd" swVersion="5.8.10" x-pid="5626" x-info="http://www.rsyslog.com"] start
NTSeverity: NULL
Importance: NULL
EventSource: NULL
EventUser: NULL
EventCategory: NULL
EventID: NULL
EventBinaryData: NULL
MaxAvailable: NULL
CurrUsage: NULL
MinUsage: NULL
MaxUsage: NULL
InfoUnitID: 1
SysLogTag: rsyslogd:
EventLogType: NULL
GenericFileName: NULL
SystemID: NULL
*************************** 3. row ***************************
ID: 3
CustomerID: NULL
ReceivedAt: 2017-05-18 18:28:51
DeviceReportedTime: 2017-05-18 18:28:51
Facility: 1
Priority: 6
FromHost: server
Message: Installed: gc-7.1-12.el6_4.x86_64
NTSeverity: NULL
Importance: NULL
EventSource: NULL
EventUser: NULL
EventCategory: NULL
EventID: NULL
EventBinaryData: NULL
MaxAvailable: NULL
CurrUsage: NULL
MinUsage: NULL
MaxUsage: NULL
InfoUnitID: 1
SysLogTag: yum[5666]:
EventLogType: NULL
GenericFileName: NULL
SystemID: NULL
*************************** 4. row ***************************
ID: 4
CustomerID: NULL
ReceivedAt: 2017-05-18 18:28:51
DeviceReportedTime: 2017-05-18 18:28:51
Facility: 1
Priority: 6
FromHost: server
Message: Installed: zile-2.4.9-1.el6.x86_64
NTSeverity: NULL
Importance: NULL
EventSource: NULL
EventUser: NULL
EventCategory: NULL
EventID: NULL
EventBinaryData: NULL
MaxAvailable: NULL
CurrUsage: NULL
MinUsage: NULL
MaxUsage: NULL
InfoUnitID: 1
SysLogTag: yum[5666]:
EventLogType: NULL
GenericFileName: NULL
SystemID: NULL
4 rows in set (0.00 sec)

###################安裝loganalyzer##################

[root@server ~]# yum install -y httpd php php-mysql ?php-gd(后面數據統計，出圖形需要用到)

[root@server ~]# netstat -ant
tcp ? ? ? ?0 ? ? ?0 :::80 ? ? ? ? ? ? ? ? ? ? ? :::* ? ? ? ? ? ? ? ? ? ? ? ?LISTEN?

測試下php,與mysql的連通性：

[root@server ~]# cd /var/www/html/
You have new mail in /var/spool/mail/root
[root@server html]# ll
total 8
-rw-r--r-- 1 root root 329 May 18 18:45 index.php
-rw-r--r-- 1 root root 20 May 18 18:42 phpinfo.php
[root@server html]# cat phpinfo.php
<?php
phpinfo();
?>
[root@server html]# cat index.php
<?php
$conn = mysql_connect('192.168.244.101','sysloguser','syslogpass');
if ($conn)
echo "OK";
else
echo "Failure";

mysql_close();
?>

[root@server ~]# curl 192.168.244.100/index.php ? ? ?#可以連接上數據庫
OK
[root@server ~]# curl -I 192.168.244.100/phpinfo.php ? #訪問php頁面OK
HTTP/1.1 200 OK

################安裝LogAnalyzer#################

[root@server ~]# cd /usr/local/src/

[root@server src]# wget http://download.adiscon.com/loganalyzer/loganalyzer-3.6.5.tar.gz

[root@server src]# mv loganalyzer-3.6.5 /var/www/html/loganalyzer
[root@server src]# cd /var/www/html/loganalyzer/

[root@server ~]# cd /var/www/html/loganalyzer/contrib/

[root@server contrib]# cat configure.sh
#!/bin/sh

touch config.php
chmod 666 config.php
[root@server contrib]# chmod +x *.sh

[root@server contrib]# ./configure.sh ? ? ?#讓其生成config.php 文件

[root@server src]# chmod 666 config.php
[root@server src]# pwd
/var/www/html/loganalyzer/src
[root@server src]# ll config.php
-rw-rw-rw- 1 root root 0 May 19 15:02 config.php

然后去瀏覽器操作：

完成！！！！！！！！！！！！！！！！！！

大致總結下過程：

配置使用基于mysql存儲日志信息：
(1) 準備好MySQL服務器，創建用戶，授權對Syslog數據庫的全部訪問權限；
(2) 安裝rsyslog-mysql程序包；
(3) 創建rsyslog-mysql依賴的數據庫；
# mysql -uUSERNAME -hHOST -pPASSWORD < /usr/share/doc/rsyslog-mysql-VERSION/createDB.sql
(4) 配置rsyslog使用ommysql模塊
#### MODULES ####
$ModLoad ommysql

#### RULES ####
facility.priority :ommysql:DBHOST,DB,DBUSER,USERPASS

重啟rsyslog服務
(5) 安裝loganalyzer
(a) 配置webserver, 支持php
# yum install httpd php php-mysql php-gd
# service httpd start
(b) loganalyzer
# cp -r loganalyzer-3.6.5/src /var/www/html/loganalyzer
# cp loganalyzer-3.6.5/contrib/*.sh /var/www/html/loganalyzer
# cd /var/www/html/loganalyzer
# chmod +x *.sh
# ./configure.sh
# ./secure.sh
# chmod 666 config.php

轉載于:https://www.cnblogs.com/shanhua-fu/p/6873960.html

創作挑戰賽新人創作獎勵來咯，堅持創作打卡瓜分現金大獎

總結

以上是生活随笔為你收集整理的Rsyslog 日志相关内容的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。

上一篇：神似华为Mate 40！鼎桥TD Tec
下一篇：这种西红柿千万别吃可能中毒