Rsyslog collection application log

Other service log collection system, operating on the client node1, exemplary service to log openstack-nova example:

1. modify the configuration file /etc/rsyslog.conf, complete as follows:

[root@node1 ~]# egrep -v '^#|^$' /etc/rsyslog.conf
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
$ModLoad immark # provides --MARK-- message capability
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
*.info;mail.none;authpriv.none;cron.none @@192.168.30.67
authPriv. * / var / log / secure
mail. * - / var / log / maillog
cron. * / var / log / cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
module(load="imfile" PollingInterval="5")
$InputFileName /var/log/nova/nova-compute.log
$InputFileTag nova-info:
$InputFileStateFile state-nova-info
$InputRunFileMonitor

 

In fact, the contents of five lines after adding only, for each of the next brief explanation

Module1 (Load = " imfile " the PollingInterval = " . 5 " ) imfile loading module, refresh and 5 seconds
InputFileName $ / var / log / Nova / nova- compute.log to monitor log file path 
Nova InputFileTag $ - info : definition file labels, note that last a colon:
State InputFileStateFile $ -nova- info             -defined state files
$ InputRunFileMonitor activation read, read log may be provided a plurality of sets, each set this parameter at the end of             

 

2. After the changes are complete, restart the client service rsyslog

[root@node1 ~]# systemctl restart rsyslog

 


Verify 3, view logs, as in FIG. Rsyslog server

 

Guess you like

Origin www.cnblogs.com/poov/p/11948877.html