Logstash combines rsyslog to collect system logs

Source: Internet
Author: User
Tags syslog logstash rsyslog

Rsyslog is a log collection tool. Currently, many Linux systems use rsyslog to replace syslog. I will not talk about how to install rsyslog. I will talk about the principle and the configuration of logstash.

Rsyslog itself has a configuration file/etc/rsyslog. conf, which defines the log file and the corresponding storage address. The following statement is used as an example:

local7.*                                                /var/log/boot.log

It indicates that all log files starting with local17. are recorded in/var/log/boot. log.

As mentioned above, it is a log collection tool. It can not only collect local logs, but also collect logs from other machines. So how can we collect it?

Remove the comments of the two lines under/ECT/rsyslog. conf:

#$ModLoad imudp#$UDPServerRun 514

Then, add-R at startup, so that it uses port 514 to listen. Of course, this has nothing to do with logstash.

The following describes the configuration of logstash:

The configuration file input is added to syslog:

syslog{   port = "5514"}

Logstash is configured, but how does rsyslog know to send it to you? It is also very easy to add the following line to/etc/rsyslog. conf:

*.*  @@ip:5514


Note: @ and the preceding * must be separated by tab. OK.

If you want to verify the code, enter the following command in shell:

logger "Hello world!"

If logstash receives the message, it indicates OK.


 

 

Logstash combines rsyslog to collect system logs

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.