我正在尝试设置我的ec2实例(运行amazon
linux,据我所知是建立在RHEL 5上)来将日志消息转发到loggentries.com,但没有任何东西被转发.作为一个完整性检查,我按照指令
in this article设置另一个ec2实例作为中央服务器,发现没有收到消息.所以我尝试在客户机上执行logger -p cron.info TEST,发现没有添加到/ var / log / cron中！有些东西显然不起作用！但是rsyslogd正在运行：
ps aux | grep rsys
root 25362 0.0 0.0 183768 1328 ? Sl 14:27 0:00 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
供参考,这里是rsyslog.conf(暂时删除了转发内容,直到我在本地工作)
#### MODULES #### $ModLoad imuxsock.so # provides support for local system logging (e.g. via logger command) $ModLoad imklog.so # provides kernel logging support (prevIoUsly done by rklogd) #$ModLoad immark.so # provides --MARK-- message capability # Provides UDP syslog reception #$ModLoad imudp.so #$UDPServerRun 514 # Provides TCP syslog reception #$ModLoad imtcp.so #$InputTCPServerRun 514 #### GLOBAL DIRECTIVES #### # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # File syncing capability is disabled by default. This feature is usually not required,# not useful and an extreme performance hit #$ActionFileEnableSync on #### RULES #### # Log all kernel messages to the console. # Logging much else clutters up the screen. kern.* /dev/console # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* -/var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * # Save news errors of level crit and higher in a special file. uucp,news.crit /var/log/spooler # Save boot messages also to boot.log local7.* /var/log/boot.log
解决方法
您在rsyslog.conf中转发到远程IP地址唯一需要的是
*.* @@192.0.2.25:514;
关于你的其他问题……
I tried executing logger -p cron.info TEST on the client machine and found nothing is added to /var/log/cron!
确保在更改配置后重新启动rsyslogd;你还需要确保/ var / log / cron存在.
编辑
为了演示成功的日志条目是什么样的,我用rsyslogd -c4 -d开始了rsyslogd;这会将所有调试发送到我的ssh会话.我正在将cron.info记录到/ var / log / syslog.在一个不同的ssh会话中,我运行了logger -p cron.info“我的测试再次”…这是我在成功登录到/ var / log / syslog之前看到的…
4578.692833385:b6d8fb70: Message from UNIX socket: #3 4578.692906216:b6d8fb70: logmsg: flags 4,from 'Bucksnort',msg Jul 15 10:02:58 mpenning: my test again 4578.692936284:b6d8fb70: Message has legacy syslog format. 4578.692977796:b6d8fb70: main Q: entry added,size now 1 entries 4578.693017277:b6d8fb70: wtpAdviseMaxWorkers signals busy 4578.693079869:b6d8fb70: main Q: EnqueueMsg advised worker start 4578.693117891:b6d8fb70: --------imuxsock calling select,active file descriptors (max 5): 3 5 4578.693210533:b7590b70: main Q: entry deleted,state 0,size now 0 entries 4578.693246128:b7590b70: testing filter,f_pmask 0 4578.693269892:b7590b70: testing filter,f_pmask 255 4578.693296429:b7590b70: Called action,logging to builtin-file 4578.693340007:b7590b70: file to log to: /var/log/syslog 4578.693369336:b7590b70: doWrite,pData->pStrm 0x96b6268,lenBuf 50 4578.693400172:b7590b70: strm 0x96b6268: file 7(syslog) flush,buflen 50 4578.693487314:b7590b70: strm 0x96b6268: file 7 write wrote 50 bytes 4578.693512965:b7590b70: testing filter,f_pmask 0 4578.693530524:b7590b70: testing filter,f_pmask 0 4578.693547988:b7590b70: testing filter,f_pmask 0 4578.693564966:b7590b70: testing filter,f_pmask 0 4578.693581783:b7590b70: testing filter,f_pmask 0 4578.693599197:b7590b70: testing filter,f_pmask 0 4578.693616153:b7590b70: testing filter,f_pmask 0 4578.693632854:b7590b70: testing filter,f_pmask 0 4578.693649647:b7590b70: testing filter,f_pmask 0 4578.693666837:b7590b70: testing filter,f_pmask 0 4578.693683852:b7590b70: testing filter,f_pmask 0 4578.693700593:b7590b70: testing filter,f_pmask 128 4578.693717070:b7590b70: testing filter,f_pmask 0 4578.693734486:b7590b70: testing filter,f_pmask 1 4578.693751624:b7590b70: testing filter,f_pmask 240 4578.693769534:b7590b70: Called action,logging to builtin-pipe 4578.693791155:b7590b70: (/dev/xconsole) 4578.693820288:b7590b70: main Q:Reg/w0: worker IDLE,waiting for work.
