Logstash combines rsyslog to collect system logs

Rsyslog is a log collection tool. Currently, many Linux systems use rsyslog to replace syslog. I will not talk about how to install rsyslog. I will talk about the principle and the configuration of logstash.

Rsyslog itself has a configuration file/etc/rsyslog. conf, which defines the log file and the corresponding storage address. The following statement is used as an example:

local7.*                                                /var/log/boot.log

It indicates that all log files starting with local17. are recorded in/var/log/boot. log.

As mentioned above, it is a log collection tool. It can not only collect local logs, but also collect logs from other machines. So how can we collect it?

Remove the comments of the two lines under/ECT/rsyslog. conf:

#$ModLoad imudp#$UDPServerRun 514

Then, add-R at startup, so that it uses port 514 to listen. Of course, this has nothing to do with logstash.

The following describes the configuration of logstash:

The configuration file input is added to syslog:

syslog{   port = "5514"}

Logstash is configured, but how does rsyslog know to send it to you? It is also very easy to add the following line to/etc/rsyslog. conf:

*.*  @@ip:5514

Note: @ and the preceding * must be separated by tab. OK.

If you want to verify the code, enter the following command in shell:

logger "Hello world!"

If logstash receives the message, it indicates OK.

 

 

Logstash combines rsyslog to collect system logs