vi /etc/rsyslog.conf
# Input Modules
#
$ModLoad impstats.so
$PStatsInterval 300
syslog.info /var/log/rsyslog-stats
#
$ModLoad immark.so # provides
$ModLoad imuxsock.so # provides support for local system logging (via logger command)
$ModLoad imklog.so # provides kernel logging support (previously done by rklogd)
#
$ModLoad imudp.so # provides UDP syslog reception
$UDPServerAddress * # all local interfaces
$UDPServerRun 514 # start UDP server (log server receiver)
#
$ModLoad imtcp.so # provides TCP syslog reception and GSS-API (if compiled)
$InputTCPServerRun 514 # start TCP server (log server receiver)
#
$ModLoad imrelp.so # RELP input
$InputRELPServerRun 20514 # start RELP Protocol
#
$ModLoad imfile.so # Text file input
$InputFileName /var/log/i-am-a-text-file.log
$InputFileTag my-text-file:
$InputFileStateFile stat-file1
$InputFileSeverity error
$InputFileFacility local7
$InputFilePollInterval 10 # check for new lines every 10 seconds
$InputRunFileMonitor
#
#$ModLoad imgssapi.so # Plain TCP and GSSAPI
#$ModLoad im1395.so # Messages via RFC1395
# Output Modules
#
$ModLoad omsnmp.so # Send SNMP traps
#$actionsnmptransport udp
#$actionsnmptarget 192.168.x.x
#$actionsnmptargetport 162
#$actionsnmpversion 1
#$actionsnmpcommunity public
#*.* 
"http://npower.vn/wp-includes/images/smilies/icon_surprised.gif" alt="icon surprised Hướng dẫn cài đặt Rsyslog 5.7.x trên nền tảng CentOS 5.x" class="wp-smiley" title="Hướng dẫn cài đặt Rsyslog 5.7.x trên nền tảng CentOS 5.x"> msnmp:#
$ModLoad ommysql.so # Log to MySQL
#$ModLoad ompgsql.so # Log to PostgreSQL
#
$ModLoad ommail.so # Send mail
#$ActionMailSMTPServer mail.example.net
#$ActionMailFrom rsyslog@example.net
#$ActionMailTo operator@example.net
#$ActionMailTo admin@example.net
#$template mailSubject,"disk problem on %hostname%"
#$template mailBody,"RSYSLOG Alertrnmsg='%msg%'"
#$ActionMailSubject mailSubject
#$ActionExecOnlyOnceEveryInterval 21600
#if $msg contains 'hard disk fatal failure' then "http://npower.vn/wp-includes/images/smilies/icon_surprised.gif" alt="icon surprised Hướng dẫn cài đặt Rsyslog 5.7.x trên nền tảng CentOS 5.x" class="wp-smiley" title="Hướng dẫn cài đặt Rsyslog 5.7.x trên nền tảng CentOS 5.x"> mmail:;mailBody#
$ModLoad omrelp.so # Send to another host via RELP
#$ModLoad omlibdbi.so # Log via generic DB output
#$ModLoad omgss.so # GSS enabled output
# Globals
$umask 0000
$DirCreateMode 0640
$FileCreateMode 0640
$RepeatedMsgReduction on
$WorkDirectory /var/log/rsyslog # default location for work (spool) files
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName queue # set file name, also enables disk mode
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
$MainMsgQueueMaxFileSize 100M
$ActionQueueMaxFileSize 5M
#
# Below find some samples of what a template can do. Have a good
# time finding out what they do [or just tun them] "http://npower.vn/wp-includes/images/smilies/icon_wink.gif" alt="icon wink Hướng dẫn cài đặt Rsyslog 5.7.x trên nền tảng CentOS 5.x" class="wp-smiley" title="Hướng dẫn cài đặt Rsyslog 5.7.x trên nền tảng CentOS 5.x"># A template that resambles traditional syslogd file output:
$template TraditionalFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%n"
# a template useful for debugging format issues
$template DEBUG,"Debug line with all properties:nFROMHOST: '%FROMHOST%', HOSTNAME: '%HOSTNAME%', PRI: %PRI%,nsyslogtag '%syslogtag%', programname: '%programname%', APP-NAME: '%APP-NAME%', PROCID: '%PROCID%', MSGID: '%MSGID%',nTIMESTAMP: '%TIMESTAMP%', STRUCTURED-DATA: '%STRUCTURED-DATA%',nmsg: '%msg%'nescaped msg: '%msg:::drop-cc%'nrawmsg: '%rawmsg%'nn"
# A template that resembles RFC 3164 on-the-wire format:
# (yes, there is NO space betwen syslogtag and msg! that's important!)
$template RFC3164fmt,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%"
# a template resembling traditional wallmessage format:
$template wallmsg,"rn7Message from syslogd@%HOSTNAME% at %timegenerated% ...rn %syslogtag%%msg%nr"
# The template below emulates winsyslog format, but we need to check the time
# stamps used. for now, it is good enough 
This format works best with# other members of the MonitorWare product family. It is also a good sample
# where you can see the property replacer in action.
$template WinSyslogFmt,"%HOSTNAME%,%timegenerated:1:10:date-rfc3339%,%timegenerated:12:19:date-rfc3339%,%timegenerated:1:10:date-rfc3339%,%timegenerated:12:19:date-rfc3339%,%syslogfacility%,%syslogpriority%,%syslogtag%%msg%n"
# A template used for database writing (notice it *is* an actual
# sql-statement):
$template dbFormat,"insert into SystemEvents (Message, Facility,FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%',%syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",sql
$template FileFormat,"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%n"
$template ForwardFormat,"<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%"
# Selector lines are somewhat different from stock syslogd. With
# rsyslog, you can add a semicolon ";" after the target and then
# the template name. That will assign this template to the respective
# action. If no template name is given, a hardcoded template is used.
# If a template name is given, but the template was not defined, the
# selector line is DEACTIVATED.
#--------------------------------------------------------------------
#--------------------------------------------------This line is comment
# Forward via TCP with maximum compression:
#$AllowedSender TCP, 127.0.0.1, 192.0.2.0/24, [::1]/128, *.example.net, somehost.example.com
#*.* @@(z9)192.168.x.x:514
# Forward via UDP with maximum compression:
#$AllowedSender UDP, 127.0.0.1, 192.0.2.0/24, [::1]/128, *.example.net, somehost.example.com
#*.* @(z9)192.168.x.x:514
# Forward via RELP Protocol :
#*.* 
mrelp:192.168.2.4:20514;TraditionalFormat# Store all log files in MySQL DB :
#*.* mmysql:127.0.0.1,Syslog,rsyslog,your-mysql-password#--------------------------------------------------This line is comment
#--------------------------------------------------This line is comment
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console;TraditionalFileFormat
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
#
$IncludeConfig /etc/rsyslog.d/*.conf
#
#if message contains 'network error' then run the restart-network.sh shell script!!!
#:msg, contains, "network error" ^/root/restart-network.sh
Sau đó, khởi động Rsyslog:
chmod 640 /etc/rsyslog.conf
service rsyslog start
tail -f /var/log/messages
Và kiểm tra quá trình hoạt động của Rsyslog như sau:
logger "this is a test message"
logger -p local0.info -t testtag "this is a test message"
Khi hệ thống hiển thị thông tin đúng theo mẫu kiểm tra thì có nghĩa là toàn bộ quá trình cài đặt và cấu hình trên đã thành công. Chúc các bạn thành công!
Theo quản trị mạng
