1 # rsyslog configuration file2 3 # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html4 # If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html5 6 #### MODULES ####   　　　　　　　　　　　　　　　　　　#模块部分
  7 8 # The imjournal module bellow is now used as a message source instead of imuxsock.9 $ModLoad imuxsock #支持本地系统 provides support for local system logging (e.g. via logger command)10 $ModLoad imjournal # provides access to the systemd journal11 #$ModLoad imklog # reads kernel messages (the same are read from journald)12 #$ModLoad immark  # provides --MARK-- message capability13 14 # Provides UDP syslog reception15 #$ModLoad imudp16 #$UDPServerRun 51417 18 # Provides TCP syslog reception19 #$ModLoad imtcp20 #$InputTCPServerRun 51421 22 23 #### GLOBAL DIRECTIVES ####　　　　　　　　　　　　　　#全局指定
 24 25 # Where to place auxiliary files26 $WorkDirectory /var/lib/rsyslog27 28 # Use default timestamp format29 $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat30 31 # File syncing capability is disabled by default. This feature is usually not required,32 # not useful and an extreme performance hit33 #$ActionFileEnableSync on34 35 # Include all config files in /etc/36 $IncludeConfig /etc/*.conf37 38 # Turn off message reception via local log socket;39 # local messages are retrieved through imjournal now.40 $OmitLocalLogging on41 42 # File to store the position in the journal43 $IMJournalStateFile imjournal.state44 45 46 #### RULES ####　　　　　　　　　　　　　　　　　#规则部分　
 47 48 # Log all kernel messages to the console.49 # Logging much else clutters up the screen.50 # 本地物理终端，比如启动引导的时候，打印在屏幕上的日志，可以用dmesg看51 #kern.*                                                 /dev/console52 53 # Log anything (except mail) of level info or higher.54 # Don't log private authentication messages!55 #可以使用分号隔开，”*.info“所有的info，排除mail ，authpriv，cron56 *.info;mail.none;authpriv.none;cron.none                /var/log/messages57 58 #如果想给发给日志服务器只需要指定服务器59 #*.info;mail.none;authpriv.none;cron.none                @192.168.216.5360 61 62 63 # The authpriv file has restricted access.64 #authpriv.* ，authpriv的任何级别65 authpriv.*                                              /var/log/secure66 67 # Log all the mail messages in one place.68 #任意的mail，-/var/log/maillog 减号是异步的意思，因为不是特别关键，所以异步，节省效率69 mail.*                                                  -/var/log/maillog70 71 72 # Log cron stuff73 cron.*                                                  /var/log/cron74 75 # Everybody gets emergency messages76 #所有登陆到系统上的用户的信息77 *.emerg                                                 :omusrmsg:*78 79 # Save news errors of level crit and higher in a special file.80 #”，“代表uucp和news都使用一个级别crit警告81 uucp,news.crit                                          /var/log/spooler82 83 # Save boot messages also to boot.log84 #自定义日志，比如说添加一个local2,对应修改sshd配置文件85 local7.*                                                /var/log/boot.log86 #local2.*                                                /var/log/sshd.log87 # ### begin forwarding rule ###88 # The statement between the begin ... end define a SINGLE forwarding89 # rule. They belong together, do NOT split them. If you create multiple90 # forwarding rules, duplicate the whole block!91 # Remote Logging (we use TCP for reliable delivery)92 #93 # An on-disk queue is created for this action. If the remote host is94 # down, messages are spooled to disk and sent when it is up again.95 #$ActionQueueFileName fwdRule1 # unique name prefix for spool files96 #$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)97 #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown98 #$ActionQueueType LinkedList   # run asynchronously99 #$ActionResumeRetryCount -1    # infinite retries if host is down
100 # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
101 #*.* @@remote-host:514
102 # ### end of the forwarding rule ###

1 #*.info;mail.none;authpriv.none;cron.none /var/log/messages
2 *.info;mail.none;authpriv.none;cron.none @192.168.216.53   #指定rsyslog服务器，很简单

　3 $ModLoad imudp
4　$UDPServerRun 514　　　　#可以指定一个udp端口，默认也是udp的，看需求安排

1 [root@web1 web]# !system
2 systemctl restart nginx

1 [root@web1 web]# rpm -ql rsyslog-mysql
2 /usr/lib64/rsyslog/ommysql.so
3 /usr/share/doc/

1 [root@web1 web]# less /usr/share/doc/
2 CREATE DATABASE Syslog;
3 USE Syslog;
4 CREATE TABLE SystemEvents

1 #### MODULES ####
2
3 $ModLoad ommysql

#### RULES ####

　　#*.info;mail.none;authpriv.none;cron.none /var/log/messages
#*.info;mail.none;authpriv.none;cron.none @192.168.216.53
*.info;mail.none;authpriv.none;cron.none :ommysql:192.168.216.53,Syslog,Syslog,admin123