日志介绍
rsyslog
rsyslog
实验一日志配置演示，
通过下边命令rsysylog服务默认是独立的不是基于网络的
应用程序定制日志演示
[root@chujiapeng ~]# vim /etc/rsyslog.conf # Save boot messages0 also to boot.log local7.* /var/log/boot.log local6.* /var/log/myssh.log
[root@chujiapeng ~]# vim /etc/ssh/sshd_config
SyslogFacility local6
[root@chujiapeng ~]# systemctl restart sshd rsyslog
[root@chujiapeng ~]#
截图查看效果
[root@chujiapeng ~]# tail /var/log/m
maillog maillog-20201226 maillog-20201227 mariadb/ messages messages-20201226 messages-20201227 myssh.log
[root@chujiapeng ~]# tail /var/log/m
maillog maillog-20201226 maillog-20201227 mariadb/ messages messages-20201226 messages-20201227 myssh.log
[root@chujiapeng ~]# tail /var/log/myssh.log
Dec 27 17:12:07 chujiapeng sshd[34281]: Server listening on 0.0.0.0 port 22.
Dec 27 17:12:07 chujiapeng sshd[34281]: Server listening on :: port 22.
Dec 27 17:12:14 chujiapeng sshd[34281]: Received signal 15; terminating.
Dec 27 17:12:14 chujiapeng sshd[34298]: Server listening on 0.0.0.0 port 22.
Dec 27 17:12:14 chujiapeng sshd[34298]: Server listening on :: port 22.
Dec 27 17:15:27 chujiapeng sshd[34346]: Accepted password for root from 192.168.170.1 port 49968 ssh2
修改给用户发、
[root@chujiapeng ~]# vim /etc/rsyslog.conf
local6.* root,chujiapeng
[root@chujiapeng ~]# systemctl restart rsyslog
给远程机器发，基于网络演示
192.168.170.27的日志发送给192.168.170.17
1.首先开启17的端口 服务，来接受和存放日志路径
vim /etc/rsyslog.conf
$ModLoad imudp
$UDPServerRun 514
local6.* /var/log/remote27.log
[root@chujiapeng ~]# systemctl restart rsyslog
[root@chujiapeng ~]# ss -ntul
State Recv-Q Send-Q Local Address:Port Peer Address:Port
UNCONN 0 0 *:5353 *:*
UNCONN 0 0 *:57747 *:*
UNCONN 0 0 *:514 *:*
UNCONN 0 0 :::514 :::*
[root@chujiapeng ~]#
2.然后在发送日志主机修改配置文件
vim /etc/rsyslog.conf
local6.* @192.168.170.17
重启服务
[root@chujiapeng ~]# systemctl restart rsyslog
测试过程详见截图
到此演示结束
实验二收集apache访问日志，并实现图形化展示。
【说明】：本文章由站长整理发布，文章内容不代表本站观点，如文中有侵权行为，请与本站客服联系(QQ:254677821)！