zhangqijun.com这上面的a51到a56,

a51是日志服务器,配置了两个子配置文件监听了两个端口

a56指向515端口不知道最后写入为什么用的还是514端口的配置的路径,没有写入到515端口配置的路径去。515的路径改成的是syslog2,最后还是写入到syslog路径

cat /etc/rsyslog.d/514.conf
$ModLoad imuxsock
$ModLoad imjournal

$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514

$WorkDirectory /var/lib/rsyslog

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$template Remote,"/var/log/syslog/%fromhost-ip%/%fromhost-ip%_%$YEAR%-%$MONTH%-%$DAY%.log"
$template Local,"/var/log/syslog/192.168.1.51/192.168.1.51_%$YEAR%-%$MONTH%-%$DAY%.log"
:fromhost-ip, !isequal, "127.0.0.1" -?Remote
:fromhost-ip, isequal, "127.0.0.1" -?Local
cat /etc/rsyslog.d/515.conf
$ModLoad imuxsock
$ModLoad imjournal

$ModLoad imudp
$UDPServerRun 515
$ModLoad imtcp
$InputTCPServerRun 515

$WorkDirectory /var/lib/rsyslog

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$template myFormat,"%timestamp% %fromhost-ip% %msg%\n"
$template Remote,"/var/log/syslog/%fromhost-ip%/%fromhost-ip%_%$YEAR%-%$MONTH%-%$DAY%.log"
$template Local,"/var/log/syslog/192.168.1.51/192.168.1.51_%$YEAR%-%$MONTH%-%$DAY%.log"
:fromhost-ip, !isequal, "127.0.0.1" -?Remote;myFormat
:fromhost-ip, isequal, "127.0.0.1" -?Local;myFormat

 

发表评论

您的电子邮箱地址不会被公开。 必填项已用*标注