CENTOS9+RSYSLOG+LOGROTATE收集日志

系统版版本为CentOS Stream release 9

rsyslog和lograte通常系统已经安装了。

#rpm -qa | grep rsyslog
rsyslog-logrotate-8.2310.0-4.el9.x86_64
rsyslog-8.2310.0-4.el9.x86_64
rsyslog-gnutls-8.2310.0-4.el9.x86_64
rsyslog-gssapi-8.2310.0-4.el9.x86_64
rsyslog-relp-8.2310.0-4.el9.x86_64
rsyslog-mysql-8.2310.0-4.el9.x86_64
#
rpm -qa | grep logrotate
logrotate-3.18.0-8.el9.x86_64
rsyslog-logrotate-8.2310.0-4.el9.x86_64

rsyslog高配本支持低版本的配置语法，下面附上我的配置

cat /etc/rsyslog.conf | egrep -v "^#|^$"
global(workDirectory="/var/lib/rsyslog")
$template myformat,"%$NOW% %TIMESTAMP:8:15% %hostname% %syslogtag% %msg%\n"
$ActionFileDefaultTemplate myformat
module(load="imuxsock" 	  # provides support for local system logging (e.g. via logger command)SysSock.Use="off") # Turn off message reception via local log socket; # local messages are retrieved through imjournal now.
module(load="imjournal" 	    # provides access to the systemd journalUsePid="system" # PID nummber is retrieved as the ID of the process the journal entry originates fromFileCreateMode="0644" # Set the access permissions for the state fileStateFile="imjournal.state") # File to store the position in the journal
module(load="ommysql")
$ModLoad ommysql
include(file="/etc/rsyslog.d/*.conf" mode="optional")
module(load="imudp") # needs to be done just once
input(type="imudp" port="514")
module(load="imtcp") # needs to be done just once
input(type="imtcp" port="514")
127.0.0.1.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          /var/log/spooler
$template NetworkDevices,"/data/logs/network-devices/%FROMHOST-IP%.log"
*.* ?NetworkDevices
*.* :ommysql:127.0.0.1,Syslog,rsyslog,dbpasswd

其中

$template myformat,"%$NOW% %TIMESTAMP:8:15% %hostname% %syslogtag% %msg%\n"
$ActionFileDefaultTemplate myformat

rsylog传过来的时间差8小时的问题，折腾了一周没解决，传过来的timestamp使用的就是utc时间格式就是差8小时，这个问题不关rsyslog配置的事。

 处理方法：在华为web界面添加ip是不会添加“local-time facility local7”这个参数的， 需要在命令行进入system-view模式添加。

info-center loghost 172.18.6.91 local-time facility local7

输入时一定要带“local-time facility local7”，虽然配置完在查看配置中发现“facility local7”不显示。

info-center loghost 172.18.6.91 local-time

下面这二行的使用是接收网络设备log

$template NetworkDevices,"/data/logs/network-devices/%FROMHOST-IP%.log"
*.* ?NetworkDevices

还有

*.info;mail.none;authpriv.none;cron.none                /var/log/messages

被我改成，避免local7的日志发到message文件里。

127.0.0.1.info;mail.none;authpriv.none;cron.none                /var/log/messages

 bootlog的一行给我删除了，没什么意义。

在/etc/logrotate.d下添加一个lograte配置 

# cat network-devices 
# Note that logs are not compressed unless "compress" is configured,
# which can be done either here or globally in /etc/logrotate.conf.
/data/logs/network-devices/*log {dailyrotate 180dateextmissingoknotifemptysharedscriptsdelaycompresspostrotate/bin/systemctl reload rsyslog.service > /dev/null 2>/dev/null || trueendscript
}

参数dateext的作用是在文件名结尾添加日期。 

手动验证下 

cd /etc/logrotate.d
logrotate -f network-devices

检验效果

在防墙配置syslog发送到日志服务器，防火墙是华为的，日志类型为local7，日志的量比较大，一天有20G左右，所以配置按天生成日志。

不使用elk和数据库是因为需要统一记录日志的设备不多，在命令行下查找更快

如下

 cat 172.18.5.1.log | egrep "172.18.111.160" | more

参考文档：

Linux日志切割工具Logrotate_logrotate日志切割-CSDN博客

Rsyslog发送日志时间转化_rsyslog时间格式-CSDN博客

CentOS7下日志轮转logrotate简单入门与实践-腾讯云开发者社区-腾讯云

https://zhuanlan.zhihu.com/p/606684608

​​​​​https://www.cnblogs.com/ggngggg/articles/17170721.html