Linux的rsyslog日誌採集及journald的日誌
阿新 • • 發佈：2018-11-22
一、rsyslog日誌
Linux核心由很多的子系統組成，包含網路、檔案訪問、記憶體管理等，子系統需要給使用者傳送一些訊息，這些訊息內容包括訊息的重要來源以及重要性等，所有這些子系統都要把訊息傳從到一個可以維護的公共訊息區，於是產生了rsyslog。
1.日誌型別
auth #使用者登陸日誌（pam生日誌） authpriv #服務認證日誌（sshd認證） kern #核心日誌 cron #定時任務日誌 lpr #印表機日誌 mail #郵件日誌 news #新聞 user #使用者相關程式日誌 local 1-7 #使用者自定義日誌2.日誌級別
debug #系統除錯資訊 info #常規資訊 warning #警告資訊 err #報錯（級別低，阻止了某個工作不能正常工作） crit #報錯（級別高，阻止了整個軟體或整個系統不能正常工作） alert #需要立即修改的資訊 emerg #核心崩潰 none #不採集任何日誌資訊3.系統常用日誌
/var/log/messages #所有日誌級別的常規資訊（不包含郵件，服務認證，定時任務) /var/log/maillog #郵件認證 /var/log/secure #服務認證日誌 /var/log/cron #定時任務日誌4.管理日誌的配置檔案
vim /etc/rsyslog.conf #檢視並修改採集日誌檔案配置，使我們能夠採集日誌到指定位置
二、日誌採集
1.接收方測試環境除錯
[[email protected] Desktop]# systemctl stop firewalld.service ##首先關閉火牆 [[email protected] Desktop]# vim /etc/rsyslog.conf ##接收方開啟UDP配置
[[email protected]Desktop]# systemctl restart rsyslog.service ##重啟日誌 [[email protected] Desktop]# > /var/log/messages ##清空日誌 [[email protected] Desktop]# cat /var/log/messages ##查詢日誌 Oct 16 09:14:00 node1 rc.local: /etc/rc.d/rc.local: connect: No route to host Oct 16 09:14:00 node1 rc.local: /etc/rc.d/rc.local: line 18: /dev/tcp/content.example.com/80: No route to host Oct 16 09:14:03 node1 rc.local: /etc/rc.d/rc.local: connect: No route to host Oct 16 09:14:03 node1 rc.local: /etc/rc.d/rc.local: line 18: /dev/tcp/content.example.com/80: No route to host
2.傳送方實驗除錯
[[email protected] Desktop]# vim /etc/rsyslog.conf [[email protected] Desktop]# systemctl restart rsyslog.service ##接收方：第一步關閉火牆，開啟UDP配置，重新啟動 ##udp協議 當設定完成後 發現無法傳輸日誌，需要設設定防火牆 ##關閉防火牆就 systemcrl stop firewalld.service
[[email protected] Desktop]# > /var/log/messages [[email protected] Desktop]# logger text [[email protected] Desktop]# cat /var/log/messages Oct 16 09:20:29 node2 rc.local: /etc/rc.d/rc.local: connect: No route to host Oct 16 09:20:29 node2 rc.local: /etc/rc.d/rc.local: line 18: /dev/tcp/content.example.com/80: No route to host Oct 16 09:20:30 node2 root: text
3.接受方檢視
[[email protected] Desktop]# > /var/log/messages [[email protected] Desktop]# cat /var/log/messages Oct 16 09:25:50 node2 rc.local: /etc/rc.d/rc.local: connect: No route to host Oct 16 09:25:50 node2 rc.local: /etc/rc.d/rc.local: line 18: /dev/tcp/content.example.com/80: No route to host
4.自定義日誌格式設定
[[email protected] Desktop]# vim /etc/rsyslog.conf [[email protected] Desktop]# systemctl restart rsyslog
在47行加入$template messages,"%timegenerated% %FROMHOST—IP% %syslogtag% %msg%\n"
[[email protected] Desktop]# > /var/log/messages [[email protected] Desktop]# logger test [[email protected] Desktop]# cat /var/log/messages Oct 16 09:47:12 127.0.0.1 rc.local: /etc/rc.d/rc.local: connect: No route to host Oct 16 09:47:12 127.0.0.1 rc.local: /etc/rc.d/rc.local: line 18: /dev/tcp/content.example.com/80: No route to host Oct 16 09:47:14 127.0.0.1 root: test Oct 16 09:47:16 172.25.254.200 rc.local: /etc/rc.d/rc.local: connect: No route to host Oct 16 09:47:16 172.25.254.200 rc.local: /etc/rc.d/rc.local: line 18: /dev/tcp/content.example.com/80: No route to host
注意：以上實驗模式經常清空日誌，在實際中操作切忌請勿隨便清空
三、systemd-journald的日誌
1..systemd-journald可移植性高，資源消耗少、結構簡單、可擴充套件、安全性高等優點。
2.安全性之所以高是因為此程式只負責對日誌進行檢視而不能對日誌進行儲存和採集,那麼關機後再開機（重啟），只能檢視到開機後的日誌，因為系統之前的日誌是儲存在記憶體中的，所以關機後就被清空了，那麼再開機時用journalctl是看不到的之前的日誌資訊的。
journalctl命令 格式： journalctl + 引數 #日誌的檢視 具體引數的含義： -p err #檢視報錯日誌 -f #監控 （使用者ctrl+c結束監控） -n 3 #最新（new）的三條日誌 -o verbose #檢視日誌詳細引數 _PID=*** #直接檢視PID為**的程式產生的日誌 --since 時間點 --until 時間點 #檢視從何時到何時的日誌3.命令練習
[[email protected] Desktop]# journalctl -n 3 -- Logs begin at Tue 2018-10-16 08:51:42 EDT, end at Tue 2018-10-16 11:05:45 EDT Oct 16 11:05:42 node1 rc.local[1347]: /etc/rc.d/rc.local: line 18: /dev/tcp/cont Oct 16 11:05:45 node1 rc.local[1347]: /etc/rc.d/rc.local: connect: No route to h Oct 16 11:05:45 node1 rc.local[1347]: /etc/rc.d/rc.local: line 18: /dev/tcp/cont
[[email protected] Desktop]# journalctl -p err -- Logs begin at Tue 2018-10-16 08:51:42 EDT, end at Tue 2018-10-16 11:08:36 ED Oct 16 08:51:42 localhost kernel: Detected CPU family 6 model 61 Oct 16 08:51:42 localhost kernel: Warning: Intel CPU model - this hardware has Oct 16 08:51:43 localhost rpcbind[196]: rpcbind terminating on signal. Restart Oct 16 08:51:46 node1 smartd[617]: Problem creating device name scan list Oct 16 08:51:46 node1 smartd[617]: In the system's table of devices NO devices Oct 16 08:51:49 node1 rpcbind[1341]: Cannot open '/var/lib/rpcbind/rpcbind.xdr' Oct 16 08:51:49 node1 rpcbind[1341]: Cannot open '/var/lib/rpcbind/portmap.xdr' Oct 16 08:51:49 node1 systemd[1]: Failed to start LSB: Starts the Spacewalk Dae Oct 16 08:52:09 node1 libvirtd[1345]: libvirt version: 1.1.1, package: 29.el7 ( Oct 16 08:52:09 node1 libvirtd[1345]: Module /usr/lib64/libvirt/connection-driv
[[email protected] Desktop]# journalctl _PID=5535 -- Logs begin at Tue 2018-10-16 08:51:42 EDT, end at Tue 2018-10-16 11:15:58 ED
[[email protected] Desktop]# journalctl --since 11:00 --until 11:01 -- Logs begin at Tue 2018-10-16 08:51:42 EDT, end at Tue 2018-10-16 11:19:31 ED Oct 16 11:00:00 node1 rc.local[1347]: /etc/rc.d/rc.local: connect: No route to Oct 16 11:00:00 node1 rc.local[1347]: /etc/rc.d/rc.local: line 18: /dev/tcp/con Oct 16 11:00:01 node1 systemd[1]: Starting Session 16 of user root. Oct 16 11:00:01 node1 systemd[1]: Started Session 16 of user root. Oct 16 11:00:01 node1 CROND[5151]: (root) CMD (/usr/lib64/sa/sa1 1 1) Oct 16 11:00:03 node1 rc.local[1347]: /etc/rc.d/rc.local: connect: No route to Oct 16 11:00:03 node1 rc.local[1347]: /etc/rc.d/rc.local: line 18: /dev/tcp/con Oct 16 11:00:09 node1 rc.local[1347]: /etc/rc.d/rc.local: connect: No route to Oct 16 11:00:09 node1 rc.local[1347]: /etc/rc.d/rc.local: line 18: /dev/tcp/con Oct 16 11:00:12 node1 rc.local[1347]: /etc/rc.d/rc.local: connect: No route to Oct 16 11:00:12 node1 rc.local[1347]: /etc/rc.d/rc.local: line 18: /dev/tcp/con Oct 16 11:00:18 node1 rc.local[1347]: /etc/rc.d/rc.local: connect: No route to Oct 16 11:00:18 node1 rc.local[1347]: /etc/rc.d/rc.local: line 18: /dev/tcp/con Oct 16 11:00:21 node1 rc.local[1347]: /etc/rc.d/rc.local: connect: No route to Oct 16 11:00:21 node1 rc.local[1347]: /etc/rc.d/rc.local: line 18: /dev/tcp/con Oct 16 11:00:27 node1 rc.local[1347]: /etc/rc.d/rc.local: connect: No route to Oct 16 11:00:27 node1 rc.local[1347]: /etc/rc.d/rc.local: line 18: /dev/tcp/con
4.讓systemd-journald將日誌儲存到硬碟中，也就是說即使系統重啟，仍然可以檢視到系統重啟之前的日誌資訊
[[email protected] Desktop]# mkdir /var/log/journal [[email protected] Desktop]# ll -d /var/log/journal/ drwxr-xr-x. 2 root root 6 Oct 16 11:30 /var/log/journal/ [[email protected] Desktop]# chgrp systemd-journal /var/log/journal ##更改目錄的所有組 ##/var/log/journal/中的日誌資訊只能被systemd-journal組所識別 [[email protected] Desktop]# ll -d /var/log/journal/ drwxr-xr-x. 2 root systemd-journal 6 Oct 16 11:30 /var/log/journal/ [[email protected] Desktop]# chmod g+s /var/log/journal ##使在/var/log/journal目錄中出現的檔案的所有組自動歸屬於該目錄的所有組 [[email protected] Desktop]# ll -d /var/log/journal/ drwxr-sr-x. 2 root systemd-journal 6 Oct 16 11:30 /var/log/journal/ [[email protected] Desktop]# ps aux | grep systemd-journald root 409 0.0 0.2 42992 4692 ? Ss 08:51 0:01 /usr/lib/systemd/systemd-journald root 6116 0.0 0.0 112644 984 pts/0 R+ 11:31 0:00 grep --color=auto systemd-journald [[email protected] Desktop]# kill -1 409 ##重新載入
[[email protected] Desktop]# date Tue Oct 16 11:34:38 EDT 2018 [[email protected] Desktop]# reboot Connection to 172.25.254.100 closed by remote host. Connection to 172.25.254.100 closed. [[email protected] ~]$ ssh [email protected] [email protected]'s password: Last login: Tue Oct 16 08:53:50 2018 from 172.25.254.69 [[email protected] ~]# journalctl
