{"id":3388,"date":"2017-07-14T22:07:40","date_gmt":"2017-07-14T14:07:40","guid":{"rendered":"https:\/\/ixyzero.com\/blog\/?p=3388"},"modified":"2017-07-14T22:25:22","modified_gmt":"2017-07-14T14:25:22","slug":"rsyslog%e4%bd%bf%e7%94%a8%e4%b9%8b%e5%9d%91","status":"publish","type":"post","link":"https:\/\/ixyzero.com\/blog\/archives\/3388.html","title":{"rendered":"rsyslog\u4f7f\u7528\u4e4b\u5751"},"content":{"rendered":"

=Start=<\/p>\n

\u7f18\u7531\uff1a<\/h4>\n

\u8bb0\u5f55\u4e00\u4e0b\u5728\u4f7f\u7528rsyslog\u8fd9\u4e2a\u7cfb\u7edf\u8f6f\u4ef6\u65f6\u78b0\u5230\u7684\u5404\u79cd\u95ee\u9898\uff0c\u65b9\u4fbf\u4ee5\u540e\u8fdb\u884c\u67e5\u8be2\u3002<\/p>\n

\u6b63\u6587\uff1a<\/h4>\n

\u53c2\u8003\u89e3\u7b54\uff1a<\/h5>\n

Linux\u7684rsyslog\u914d\u7f6e
\nhttp:\/\/cn.linux.vbird.org\/linux_basic\/0570syslog.php#syslogd_conf<\/a><\/p>\n

\n
\n
\n
\n\n\n\n
\n
\n
`<\/span><\/span><\/div>\n
\u670d\u52a1\u540d\u79f0[.=!]\u4fe1\u606f\u7b49\u7ea7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u4fe1\u606f\u8bb0\u5f55\u7684\u6587\u4ef6\u540d\u6216\u88c5\u7f6e\u6216\u4e3b\u673a<\/code><\/div>\n
#<\/div>\n
mail.info\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/var\/log\/maillog_info<\/code><\/div>\n
# \u4e0a\u9762\u8fd9\u4e00\u884c\u8bf4\u660e\uff1amail \u670d\u52a1\u4ea7\u751f\u7684\u5927\u4e8e\u7b49\u4e8e info \u7b49\u7ea7\u7684\u4fe1\u606f\uff0c\u90fd\u8bb0\u5f55\u5230 \/var\/log\/maillog_info \u6587\u4ef6\u4e2d\u7684\u610f\u601d\u3002<\/code><\/div>\n
#<\/div>\n
mail.*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 -\/var\/log\/maillog<\/code><\/div>\n
# \u4e0a\u9762\u8fd9\u4e00\u884c\u8bf4\u660e\uff1amail \u670d\u52a1\u4ea7\u751f\u7684\u4fe1\u606f\uff0c\u90fd\u8bb0\u5f55\u5230 \/var\/log\/maillog_info \u6587\u4ef6\u4e2d\u7684\u610f\u601d\u3002\u5728\u8bb0\u5f55\u7684\u6587\u4ef6 \/var\/log\/maillog \u524d\u9762\u8fd8\u6709\u4e2a\u51cf\u53f7\u300e - \u300f\u662f\u5e72\u561b\u7528\u7684\uff1f\u7531\u4e8e\u90ae\u4ef6\u6240\u4ea7\u751f\u7684\u4fe1\u606f\u6bd4\u8f83\u591a\uff0c\u56e0\u6b64\u6211\u4eec\u5e0c\u671b\u90ae\u4ef6\u4ea7\u751f\u7684\u4fe1\u606f\u5148\u50a8\u5b58\u5728\u901f\u5ea6\u8f83\u5feb\u7684\u5185\u5b58\u4e2d (buffer) \uff0c\u7b49\u5230\u6570\u636e\u91cf\u591f\u5927\u4e86\u624d\u4e00\u6b21\u6027\u7684\u5c06\u6240\u6709\u6570\u636e\u90fd\u586b\u5165\u78c1\u789f\u5185\uff0c\u8fd9\u6837\u5c06\u6709\u52a9\u65bc\u767b\u5f55\u6587\u4ef6\u7684\u5b58\u53d6\u6027\u80fd\u3002\u53ea\u4e0d\u8fc7\u7531\u65bc\u4fe1\u606f\u662f\u7f13\u5b58\u5728\u5185\u5b58\u5185\uff0c\u56e0\u6b64\u82e5\u4e0d\u6b63\u5e38\u5173\u673a\u5bfc\u81f4\u767b\u5f55\u8d44\u8baf\u672a\u56de\u586b\u5230\u767b\u5f55\u6587\u4ef6\u4e2d\uff0c\u53ef\u80fd\u4f1a\u9020\u6210\u90e8\u5206\u6570\u636e\u7684\u9057\u5931\u3002<\/code><\/div>\n
#<\/div>\n
local6.notice\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>@192<\/code>.168.<\/code>10.199<\/code>:<\/code>514<\/code><\/div>\n
# \u4e0a\u9762\u8fd9\u4e00\u884c\u8bf4\u660e\uff1alocal6 \u670d\u52a1\u4ea7\u751f\u7684\u5927\u4e8e\u7b49\u4e8e notice \u7b49\u7ea7\u7684\u4fe1\u606f\uff0c\u90fd\u4ee5 UDP \u534f\u8bae\u8f6c\u53d1\u5230\u00a0<\/code>192.168<\/code>.<\/code>10.199<\/code>\u00a0\u673a\u5668\u4e0a\u7684\u00a0<\/code>514<\/code>\u00a0\u7aef\u53e3\u4e0a\u3002<\/code><\/div>\n
#<\/div>\n
local6.notice\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 @<\/code>@192<\/code>.168.<\/code>10.199<\/code>:<\/code>514<\/code><\/div>\n
# \u4e0a\u9762\u8fd9\u4e00\u884c\u8bf4\u660e\uff1alocal6 \u670d\u52a1\u4ea7\u751f\u7684\u5927\u4e8e\u7b49\u4e8e notice \u7b49\u7ea7\u7684\u4fe1\u606f\uff0c\u90fd\u4ee5 TCP \u534f\u8bae\u8f6c\u53d1\u5230\u00a0<\/code>192.168<\/code>.<\/code>10.199<\/code>\u00a0\u673a\u5668\u4e0a\u7684\u00a0<\/code>514<\/code>\u00a0\u7aef\u53e3\u4e0a\u3002<\/code><\/div>\n
#<\/div>\n
# rsyslog\u652f\u6301\u5728\u8f6c\u53d1\u81f3\u8fdc\u7a0b\u670d\u52a1\u5668\u7684\u540c\u65f6\u4e5f\u5728\u672c\u5730\u5b58\u4e00\u4efd\uff0c\u793a\u4f8b\u5982\u4e0b\uff1a<\/code><\/div>\n
local6.notice\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 @<\/code>@192<\/code>.168.<\/code>10.199<\/code>:<\/code>514<\/code><\/div>\n
local6.notice\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/var\/log\/local6_notice<\/code><\/div>\n
& ~<\/code><\/div>\n
#<\/div>\n
# rsyslog\u6839\u636e\u670d\u52a1\u540d\u79f0\u548ctag\u8fdb\u884c\u5206\u7c7b\u5904\u7406<\/code><\/div>\n
if<\/code>\u00a0$syslogfacility-text ==\u00a0<\/code>'local1'<\/code>\u00a0and $syslogtag ==\u00a0<\/code>'Security:'<\/code>\u00a0then\u00a0 -\/var\/log\/security.log<\/code><\/div>\n
& ~<\/code><\/div>\n
`<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

&<\/p>\n

\n
\n
\n
\n\n\n\n
\n
\n
\n
<\/code><\/div>\n
<\/div>\n<\/div>\n<\/div>\n
\n
\n
# vim \/etc\/rsyslog.d\/remote.conf<\/code><\/div>\n
$ActionQueueType LinkedList<\/code><\/div>\n
$ActionQueueFileName example_fwd<\/code><\/div>\n
$ActionResumeRetryCount -<\/code>1<\/code><\/div>\n
$ActionQueueSaveOnShutdown on<\/code><\/div>\n
local6.*\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 @<\/code>@10<\/code>.4.<\/code>93.104<\/code>:<\/code>514<\/code><\/div>\n<\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

&<\/p>\n

Ubuntu\u670d\u52a1\u5668\u6162\u6162\u505c\u6b62\u54cd\u5e94
\nhttp:\/\/b.kl3in.com\/2011\/10\/ubuntu-server-slowly-stops-responding\/<\/a><\/p>\n

syslog() -> \/dev\/log -> rsyslogd -> local file\/remote server<\/p>\n

syslog submits a message to the Syslog facility. It does this by writing to the Unix domain socket \/dev\/log.<\/p>\n

&<\/p>\n

\/dev\/log<\/p>\n

https:\/\/stackoverflow.com\/questions\/40787610\/how-to-read-dev-log<\/a>
\nhttps:\/\/linux.die.net\/man\/8\/syslogd<\/a>
\nhttp:\/\/man7.org\/linux\/man-pages\/man8\/rsyslogd.8.html<\/a>
\nhttps:\/\/www.gnu.org\/software\/libc\/manual\/html_node\/Overview-of-Syslog.html<\/a>
\nhttp:\/\/blog.csdn.net\/robbie1314520\/article\/details\/6077217<\/a>
\nhttp:\/\/www.chinabaike.com\/z\/jd\/2012\/0409\/1098299.html<\/a><\/p>\n

\n
\n
\n
\n\n\n\n
\n
\n
import<\/code>\u00a0socket<\/code><\/div>\n
import<\/code>\u00a0time<\/code><\/div>\n
<\/div>\n
sock = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)<\/code><\/div>\n
sock.bind(<\/code>'\/dev\/log'<\/code>)\u00a0 #\u9700\u8981\u5148\u624b\u52a8kill\u6389\u5df2\u7ecf\u5728\u8fd0\u884c\u7684[r]syslogd\u8fdb\u7a0b\uff0c\u5426\u5219\u8fd9\u91cc\u65e0\u6cd5\u6267\u884c\u6210\u529f<\/code><\/div>\n
while<\/code>\u00a0True:<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>time.sleep(<\/code>5<\/code>)<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>data, addr = sock.recvfrom(<\/code>1024<\/code>)<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>print(data)<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

&<\/p>\n

\n
\n
\n
\n\n\n\n
\n
\n
`<\/span><\/span><\/div>\n
Kafka \/ Scribe \/ Flume<\/code><\/div>\n
<\/div>\n
I hate to be that guy, but\u00a0<\/code>this<\/code>\u00a0software (with a patent, natch) is definitely not the first or best solution to the potential problem of the \/dev\/log buffer filling up.<\/code><\/div>\n
If the standard syslogd is inadequate, how about using a different logger? Gerritt Pape<\/code>'s svlogd, an implementation of DJB'<\/code>s daemontools loggers, solves\u00a0<\/code>this<\/code>\u00a0problem very nicely, is very reliable, can log over UDP and write to disk\u00a0<\/code>if<\/code>\u00a0desired. Heck, it can even replace syslog and run more reliably.<\/code><\/div>\n
Not to say that\u00a0<\/code>this<\/code>\u00a0software is not useful. It is a great solution\u00a0<\/code>if<\/code>\u00a0the client software insists on using syslog and cannot be modified or reconfigured and syslogd cannot be modified or replaced. However, these are quite specific and generally unusual cases. For more prosaic circumstances, there are simpler and better solutions.<\/code><\/div>\n
`<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\u53c2\u8003\u94fe\u63a5\uff1a<\/h5>\n

http:\/\/www.linuxquestions.org\/questions\/red-hat-31\/sshd-hangs-rsyslog-related-4175550947\/<\/a><\/p>\n

http:\/\/b.kl3in.com\/2011\/10\/ubuntu-server-slowly-stops-responding\/<\/a>
\nhttps:\/\/stackoverflow.com\/questions\/40787610\/how-to-read-dev-log<\/a><\/p>\n

 <\/p>\n

Unable to login to the system (eg. with ssh) after rsyslog crashes, it looks frozen
\nhttps:\/\/access.redhat.com\/solutions\/1250933<\/a><\/p>\n

Rsyslog freezes the box when can’t send logs over TCP
\nhttps:\/\/lists.gt.net\/rsyslog\/users\/7949<\/a><\/p>\n

20.4. WORKING WITH QUEUES IN RSYSLOG #\u5f53\u9700\u8981\u4f7f\u7528rsyslog\u7684TCP\u8f6c\u53d1\u529f\u80fd\u65f6\uff0c\u6700\u597d\u5355\u72ec\u4e3a\u5176\u6307\u5b9aqueue\uff0c\u907f\u514d\u5f71\u54cd\u6574\u4e2a\u7cfb\u7edf
\nhttps:\/\/access.redhat.com\/documentation\/en-US\/Red_Hat_Enterprise_Linux\/7\/html\/System_Administrators_Guide\/s1-working_with_queues_in_rsyslog.html<\/a><\/p>\n

\u8ba9 syslog() \u4e0d\u518d\u963b\u585e
\nhttps:\/\/news.ycombinator.com\/item?id=7219914<\/a>
\nhttps:\/\/github.com\/facebook\/liblogfaf<\/a><\/p>\n

=END=<\/p>\n","protected":false},"excerpt":{"rendered":"

=Start= \u7f18\u7531\uff1a \u8bb0\u5f55\u4e00\u4e0b\u5728\u4f7f\u7528rsyslog\u8fd9\u4e2a\u7cfb\u7edf\u8f6f\u4ef6\u65f6\u78b0\u5230\u7684\u5404\u79cd\u95ee\u9898\uff0c\u65b9\u4fbf\u4ee5\u540e\u8fdb\u884c\u67e5\u8be2\u3002 \u6b63\u6587\uff1a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23,11,12],"tags":[838,30,692,841],"class_list":["post-3388","post","type-post","status-publish","format-standard","hentry","category-knowledgebase-2","category-linux","category-tools","tag-devlog","tag-linux","tag-rsyslog","tag-system_administrators_guide"],"views":7668,"_links":{"self":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3388","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/comments?post=3388"}],"version-history":[{"count":4,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3388\/revisions"}],"predecessor-version":[{"id":3417,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/posts\/3388\/revisions\/3417"}],"wp:attachment":[{"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/media?parent=3388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/categories?post=3388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ixyzero.com\/blog\/wp-json\/wp\/v2\/tags?post=3388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}