# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html
#
# Default logging rules can be found in /etc/rsyslog.d/50-default.conf


#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")

###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages
$RepeatedMsgReduction on

#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf

#  Default rules for rsyslog.
#
#			For more information see rsyslog.conf(5) and /etc/rsyslog.conf

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*			/var/log/auth.log
*.*;auth,authpriv.none		-/var/log/syslog
#cron.*				/var/log/cron.log
#daemon.*			-/var/log/daemon.log
kern.*				-/var/log/kern.log
#lpr.*				-/var/log/lpr.log
mail.*				-/var/log/mail.log
#user.*				-/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
#mail.info			-/var/log/mail.info
#mail.warn			-/var/log/mail.warn
mail.err			/var/log/mail.err

#
# Some "catch-all" log files.
#
#*.=debug;\
#	auth,authpriv.none;\
#	news.none;mail.none	-/var/log/debug
#*.=info;*.=notice;*.=warn;\
#	auth,authpriv.none;\
#	cron,daemon.none;\
#	mail,news.none		-/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg				:omusrmsg:*

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#	news.=crit;news.=err;news.=notice;\
#	*.=debug;*.=info;\
#	*.=notice;*.=warn	/dev/tty8

secure    #系统安全日志，文本格式，应周期性分析
btmp      #当前系统上，用户的失败尝试登录相关的日志信息，二进制格式，lastb命令进行查看
wtmp      #当前系统上，用户正常登录系统的相关日志信息，二进制格式，last命令可以查看
lastlog   #每一个用户最近一次的登录信息，二进制格式，lastlog命令可以查看
dmesg     #CentOS7 之前版本系统引导过程中的日志信息，文本格式，开机后的硬件变化将不再记录，专用命令dmesg查看，可持续记录硬件变化的情况
boot.log  #系统服务启动的相关信息，文本格式
messages  #系统中大部分的信息
anaconda  #anaconda的日志

#Centos
yum -y install rsyslog

[root@client ~]# rpm -ql rsyslog
/etc/logrotate.d/syslog
/etc/pki/rsyslog
/etc/rsyslog.conf #主配置文件
/etc/rsyslog.d #子配置文件
/etc/sysconfig/rsyslog #环境变量文件
/usr/bin/rsyslog-recover-qi.pl
/usr/lib/systemd/system/rsyslog.service #service文件
/usr/sbin/rsyslogd #主程序
/usr/lib64/rsyslog/*.so #各种库文件
...

#/etc/rsyslog.conf

#### MODULES #### 相关模块配置
...

#### GLOBAL DIRECTIVES #### 全局配置
...

#### RULES #### 日志记录相关的规则配置

#语法
facility.priority[;facility.priority...]    target

#facility(类别)
*     #所有的类别  
auth, authpriv, cron, daemon,ftp,kern, lpr, mail, news, security(auth), user, uucp,syslog,... #指定的facility列表
local0-local7 #自定义的facility

#priority
* #所有级别
none #没有级别，即不记录
PRIORITY #指定级别（含）以上的所有级别
=PRIORITY #仅记录指定级别的日志信息

#PRIORITY：括号内的不用添加，从低到高排序
debug, info, notice, warn(warning), err(error), crit(critical), alert, emerg(panic)

#target
文件路径 #通常在/var/log/，文件路径前的-表示异步写入（异步写入表示当文件更新时 并不将更新的数据立即写入磁盘 而是先写入到缓冲区中 然后择时在写入磁盘）
用户 #将日志事件通知给指定的用户，* 表示登录的所有用户
日志服务器 #@host，把日志送往至指定的远程UDP日志服务器 @@host 将日志发送到远程TCP日志服务器
管道 # | COMMAND，转发给其它命令处理

#修改sshd服务的配置
Vim /etc/ssh/sshd_config
SyslogFacility local2
Service sshd reload

#修改rsyslog的配置
Vim /etc/rsyslog.conf
Local2.* /var/log/sshd.log
Systemctl  restart rsyslog

#测试
Ssh登录后，查看/var/log/sshd.log有记录

#logger测试
logger -p local2.info "hello sshd"
tail /var/log/sshd.log有记录

[root@client ~]# rpm -ql systemd
...
/etc/systemd/journald.conf #journald主配置文件
/usr/bin/journalctl #journald主程序
...

journalctl [OPTIONS...] [MATCHES...]

#查看所有日志（默认情况下 ，只保存本次启动的日志）
 journalctl

#查看内核日志（不显示应用日志）
 journalctl -k

#查看系统本次启动的日志
 journalctl -b
 journalctl -b -0

#查看上一次启动的日志（需更改设置）
 journalctl -b -1

#查看指定时间的日志
 journalctl --since="2017-10-30 18:10:30"
 journalctl --since "20 min ago"
 journalctl --since yesterday
 journalctl --since "2017-01-10" --until "2017-01-11 03:00"
 journalctl --since 09:00 --until "1 hour ago"

#显示尾部的最新10行日志
 journalctl -n

#显示尾部指定行数的日志
 journalctl -n 20

#实时滚动显示最新日志
 journalctl -f

#查看指定服务的日志
 journalctl /usr/lib/systemd/systemd

#查看指定进程的日志
 journalctl _PID=1 #查看某个路径的脚本的日志
 journalctl /usr/bin/bash

#查看指定用户的日志
 journalctl _UID=33 --since today

#查看某个 Unit 的日志
 journalctl -u nginx.service
 journalctl -u nginx.service --since today

#实时滚动显示某个 Unit 的最新日志
 journalctl -u nginx.service -f

#合并显示多个 Unit 的日志
 journalctl -u nginx.service -u php-fpm.service --since today

#查看指定优先级（及其以上级别）的日志，共有8级 0: emerg
1: alert
2: crit
3: err
4: warning
5: notice
6: info
7: debug
 journalctl -p err -b

#日志默认分页输出，--no-pager 改为正常的标准输出
 journalctl --no-pager

#日志管理journalctl

#以 JSON 格式（单行）输出
 journalctl -b -u nginx.service -o json

#以 JSON 格式（多行）输出，可读性更好
 journalctl -b -u nginx.serviceqq -o json-pretty

#显示日志占据的硬盘空间
 journalctl --disk-usage

#指定日志文件占据的最大空间
 journalctl --vacuum-size=1G

#指定日志文件保存多久
 journalctl --vacuum-time=1years

#Centos
yum -y install logrotate

[root@client ~]# rpm -ql logrotate
/etc/cron.daily
/etc/cron.daily/logrotate #计划任务文件
/etc/logrotate.conf #主配置文件
/etc/logrotate.d #子配置文件
/etc/logrotate.d/btmp
/etc/logrotate.d/wtmp
/etc/rwtab.d/logrotate
/usr/lib/.build-id
/usr/lib/.build-id/62
/usr/lib/.build-id/62/0770611fb2586f99b722af13432d6b0aec93b1
/usr/sbin/logrotate #主程序
/usr/share/doc/logrotate
/usr/share/doc/logrotate/ChangeLog.md
/usr/share/licenses/logrotate
/usr/share/licenses/logrotate/COPYING
/usr/share/man/man5/logrotate.conf.5.gz
/usr/share/man/man8/logrotate.8.gz
/var/lib/logrotate
/var/lib/logrotate/logrotate.status #日志文件

#cat /etc/cron.daily/logrotate

#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit $EXITVALUE

#cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# system-specific logs may be also be configured here.

[root@client ~]# cat /etc/logrotate.d/bootlog 
/var/log/boot.log
{
    missingok #如果日志不存在，不提示错误，继续处理下一个
    daily #指定转储周期为每天
    copytruncate #备份日志文件但是不截断
    rotate 7 #指定日志文件删除之前转储的次数，只保留7个备份
    notifempty #如果是空文件的话，不转储
}

#cat /etc/logrotate.d/nginx 

[root@aliyun logs]# cat /etc/logrotate.d/nginx
/apps/nginx/logs/access.log {
   daily
   rotate 100
   missingok
   compress
   delaycompress
   notifempty
   create 644 nginx nginx
   postrotate #日志转储完毕后执行以下命令，下面的命令表示生成新的配置文件
     if [ -f /apps/nginx/run/nginx.pid ]; then
         kill -USR1 `cat /apps/nginx/run/nginx.pid` #USR1是nginx内置的一个信号 表示重新打开日志文件，详参：man nginx）
     fi
   endscript
}

#生成测试日志
[root@centos8 ~]#dd if=/dev/zero of=/var/log/test1.log bs=2M count=1
1+0 records in
1+0 records out
2097152 bytes (2.1 MB, 2.0 MiB) copied, 0.00291879 s, 719 MB/s
[root@centos8 ~]#dd if=/dev/zero of=/var/log/test2.log bs=2M count=1
1+0 records in
1+0 records out
2097152 bytes (2.1 MB, 2.0 MiB) copied, 0.00200561 s, 1.0 GB/s
#针对不同的日志创建转储配置文件
[root@centos8 ~]#cat /etc/logrotate.d/test1
/var/log/test1.log {
   daily
   rotate 5
   compress
   delaycompress
   missingok
   size 1M
   notifempty
   create 644 root root
   postrotate
 echo `date +%F_%T` >> /data/test1.log
   endscript
}
[root@centos8 ~]#cat /etc/logrotate.d/test2
/var/log/test2.log {
   daily
   rotate 5
   compress
   delaycompress
   missingok
   size 1M
   notifempty
   create 644 root root
   postrotate
 echo `date +%F_%T` >> /data/test2.log
   endscript
}

#针对一个测试日志，手动执行日志转储
[root@centos8 ~]#logrotate   /etc/logrotate.d/test1    
[root@centos8 ~]#ll /var/log/test*
-rw-r--r-- 1 root root       0 Dec 14 16:38 /var/log/test1.log
-rw-r--r-- 1 root root 2097152 Dec 14 16:35 /var/log/test1.log.1
-rw-r--r-- 1 root root 2097152 Dec 14 16:36 /var/log/test2.log
[root@centos8 ~]#ls /data
test1.log
[root@centos8 ~]#cat /data/test1.log 
2019-11-12_14:00:14

#对所有日志进行手动转储
[root@centos8 ~]#logrotate   /etc/logrotate.conf 
[root@centos8 ~]#ll /var/log/test*
-rw-r--r-- 1 root root       0 Nov 12 14:00 /var/log/test1.log
-rw-r--r-- 1 root root 2097152 Nov 12 13:59 /var/log/test1.log.1
-rw-r--r-- 1 root root       0 Nov 12 14:01 /var/log/test2.log
-rw-r--r-- 1 root root 2097152 Nov 12 13:59 /var/log/test2.log-20191112
[root@centos8 ~]#ls /data
test1.log test2.log
[root@centos8 ~]#cat /data/test1.log 
2019-11-12_14:01:51

#-t表示添加标签
[root@keepalived1 ~]# logger -t testlog "hahaha"

#显示的结果
[root@keepalived1 ~]# tail -f /var/log/messages
Feb 18 19:16:01 keepalived1 testlog[14723]: hahaha

#在rsyslog服务器上安装连接mysql模块相关的程序包

yum install rsyslog-mysql

rpm -ql rsyslog-mysql
/usr/lib/.build-id
/usr/lib/.build-id/d7
/usr/lib/.build-id/d7/77fc839aa07e92f0a8858cf3f122996436c7df
/usr/lib64/rsyslog/ommysql.so
/usr/share/doc/rsyslog/mysql-createDB.sql #将此文件拷贝到mysql服务器上

scp /usr/share/doc/rsyslog/mysql-createDB.sql 10.0.0.18:/data

#准备MySQL Server
yum install mariadb-server

#在mariadb数据库服务器上创建相关数据库和表，并授权rsyslog能连接至当前服务器
mysql -u 

#mysql>source /data/mysql-createDB.sql
mysql < /data/mysql-createDB.sql

mysql>GRANT ALL ON Syslog.* TO 'rsyslog'@'10.0.0.%' IDENTIFIED BY 'magedu';

#配置rsyslog将日志保存到mysql中

vim /etc/rsyslog.conf
#
####MODULES####
#在 MODULES 语言下面，如果是 CentOS 8 加下面行
module(load="ommysql") #在 MODULES 语言下面，如果是 CentOS 7，6 加下面行
$ModLoad ommysql 
#在RULES语句块加下面行的格式
#facility.priority   :ommysql:DBHOST,DBNAME,DBUSER, PASSWORD 
*.info :ommysql:10.0.0.18,Syslog,rsyslog,magedu

systemctl restart rsyslog.service

#在日志服务器上生成日志
logger "this is a test log"

#在数据库上查询到上面的测试日志
mysql>SELECT COUNT(*) FROM SystemEvents;