【rsyslog】通过mysql 存储 rsyslog 日志信息

一、配置客户端

# rsyslogd（/etc/rsyslog.conf）
vim /etc/rsyslog.conf

*.* @@<logserver Ip>:514

二、配置日志服务器

2.1 安装rsyslogd mysql模块

yum -y install rsyslog-mysql

2.2 配置接收 rsyslog 配置文件，并存入mysql

# 在/etc/rsyslog.conf
$ModLoad imtcp
$InputTCPServerRun 514

在/etc/rsyslogd/rsyslog.d/mysql.conf

module (load="ommysql")

#*.* action(type="ommysql" server="localhost" db="Syslog" uid="rsyslog" pwd="")

if $hostname != "localhost.localdomain" then {
    
    
    $template dbFormat,"insert into SystemEvents (Message, Facility,FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%fromhost-ip%',%syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",sql

    action(type="ommysql" server="localhost" serverport="<serverport>" db="<dbname>" uid="<mysql_user>" pwd="<mysql_password>" template="dbFormat")
}

2.3 重启rsyslogd

sudo service rsyslog restart

2.4 是否开启514端口

查看：iptables-save | grep 514
添加并保存：iptables -I INPUT -p tcp --dport 514 -j ACCEPT && iptables-save | grep 514

拓展

timegenerated，timereported 区别