Log collection (i)

Nonsense not much to say, directly into the subject.

The overall architecture is

The client is unified with Rsyslog log collection, which is displayed on the >elasticsearch+kibana server---The >FLUENTD server---the >MONGONDB cluster---.

Rsyslog Installation and Configuration

1. Change The history format

Create the history.sh script in the /etc/profile.d directory , as follows

histtimeformat= '%F%T '

histfilesize=10000

histsize=1000

Histignore= ' Ls-l:pwd:date '

Histcontrol=ignoredups

export histtimeformat  Histfilesize histsize histignore histcontrol

2, set Information format (change the date displayed) and some delivery configuration

Modify /etc/rsyslog.conf the configuration

Write off two lines

# Use default timestamp format

# $ActionFileDefaultTemplate Rsyslog_traditionalfileformat

Add six lines.

$template Xsformat, "% $NOW%%timestamp:8:15%%fromhost%%syslogtag%%msg%\n"

$ActionFileDefaultTemplate Xsformat

$ModLoad imtcp

$UDPServerRun 514

*.info;mail.none;authpriv.none; cron.none;local4.none                 @@192.168.2.2  # Modify the first bar, add Local4.none, and then cancel the LOCAL4 received message will be transferred to

local4.*                         @@192.168.2.1

1. Modify the environment variables in the/ETC/BASHRC, this environment setting is inherited when the user logs on to the system

At the end, add the following information

2. Read the modified variables and start the service from the new

[Email protected] ~]# Source/etc/profile

[Email protected] ~]# SOURCE/ETC/BASHRC

[Email protected] ~]#/etc/init.d/rsyslog restart

3. Modify the server-side configuration file

server that collects secure logs

[[email protected] ~]# vim/etc/rsyslog.conf # Add the following information in the configuration file

$ModLoad imtcp

$InputTCPServerRun 514

If $fromhost-ip startswith ' 192.168.2. ' Then/var/log/allsecure.log

& ~

Collecting log servers for messages

[[email protected] ~]# vim/etc/rsyslog.conf # Add the following information in the configuration file

$ModLoad imtcp

$InputTCPServerRun 514

If $fromhost-ip startswith ' 192.168.2. ' Then/var/log/allmessageslog.log

Log collection (i)