rsyslog配置过程.docxVIP

Rsyslog 系统 redhat6.4 Rsyslog系统默认已经安装但是没有安装rsyslog-mysql服务端ip：53客户端ip：52两天服务器先同步一下时间服务端安装的软件：[root@rsyslog ~]# yum install http* php* mysql* rsyslog*安装完成后启动mysql设置mysql密码导入日文件的sql脚本，生成日志文件数据库登录mysql数据库设置用户访问数据库服务器中Syslog数据库的用户名和密码重读授权表，及时生效登录Syslog日志服务器查询，如果有数据表示成功测试：在客户端生成一条log日志查看本地log日志查看服务端日志进入mysql查看Rsyslog client 端配置文件[root@rsyslog ~]# cat /etc/rsyslog.conf # rsyslog v5 configuration file# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html# If you experience problems, see /doc/troubleshoot.html#### MODULES ####$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)$ModLoad imklog # provides kernel logging support (previously done by rklogd)#$ModLoad immark # provides --MARK-- message capability# Provides UDP syslog reception#$ModLoad imudp#$UDPServerRun 514# Provides TCP syslog reception#$ModLoad imtcp#$InputTCPServerRun 514#### GLOBAL DIRECTIVES ##### Use default timestamp format$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat# File syncing capability is disabled by default. This feature is usually not required,# not useful and an extreme performance hit#$ActionFileEnableSync on# Include all config files in /etc/rsyslog.d/$IncludeConfig /etc/rsyslog.d/*.conf#$ModLoad ommysql*.* :ommysql:53,Syslog,root,rehdat//次句话的意思是以root用户redhat密码登录到Syslog数据库#### RULES ##### Log all kernel messages to the console.# Logging much else clutters up the screen.#kern.* /dev/console# Log anything (except mail) of level info or higher.# Dont log private authentication messages! #*.info;mail.none;authpriv.none;cron.none /var/log/messages# The authpriv file has restricted access. #authpriv.* /var/log/secure# Log all the mail messages in one place. #mail.* -/var/log/maillog# Log cron stuff #cron.* /var/log/cron# Everybody g