部署 服務(wù)器 配置rsyslog
1草雕、安裝抵怎，導(dǎo)入數(shù)據(jù)庫結(jié)構(gòu)莺债，及配置mysql帳號
cd /etc/yum.repos.d/
wget http://rpms.adiscon.com/v8-stable/rsyslog.repo
yum install rsyslog
yum install rsyslog-mysql -y
source /usr/share/doc/rsyslog-mysql-8.2004.0/createDB.sql
grant all privileges on syslog_db.* to Syslog@'localhost' identified by 'passowrd';
flush privileges;
rsyslog.conf底部增加
$template Remote,"insert into SystemEvents (Message, Facility, FromHost, FromIP, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', '%fromhost-ip%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL
$ModLoad ommysql
*.*:ommysql:localhost,Syslog,syslog,passowrd
$ModLoad immark
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
2、配置需要記錄的服務(wù)器【客戶端】
配置記錄命令
/etc/profile 底部添加
export HISTTIMEFORMAT="%Y-%m-%d %H:%M:%S "
export PROMPT_COMMAND='{ command=$(history 1 | { read x y; echo $y; }); logger -p local5.notice -t bash -i "user=$USER,ppid=$PPID,logintime=$(who am i |awk "{print \$3\" \"\$4}"),from=$SSH_CLIENT,pwd=$PWD,command:$command"; }'
source /etc/profile 執(zhí)行使上面增加的配置生效
rsyslog.conf 接收數(shù)據(jù)的服務(wù)端的ip及端口信息
local5.* @10.13.1.91:514
修改完需要重啟rsyslog
配置過渡不需要的參數(shù)
vi /etc/rsyslog.d/ignore-systemd-session-slice.conf
#cron定時任務(wù)到千，會生成昌渤，很多無用數(shù)據(jù)
if $programname == "systemd" and ($msg contains "Starting Session" or $msg contains "Started Session" or $msg contains "Created slice" or $msg contains "Starting user-" or $msg contains "Starting User Slice of" or $msg contains "Removed session" or $msg contains "Removed slice User Slice of" or $msg contains "Stopping User Slice of") then stop
#aws的會有這個垃圾數(shù)據(jù)
if $programname == "dhclient" and ($msg contains "XMT: Solicit on eth0") then stop
#cron 定時任務(wù)
if $programname == "crond" and ($msg contains "sendmail: fatal: parameter inet_interfaces: no local interface found for ::1") then stop
參考文章
https://www.rsyslog.com/doc/v8-stable/configuration/modules/ommysql.html
https://cloud.tencent.com/developer/article/1025923
https://cloud.tencent.com/developer/article/1520941
