$ rsyslogd -version

rsyslogd 5.8.10, compiled with:

FEATURE_REGEXP: Yes

FEATURE_LARGEFILE: No

GSSAPI Kerberos 5 support: Yes

FEATURE_DEBUG (debug build, slow code): No

32bit Atomic operations supported: Yes

64bit Atomic operations supported: Yes

Runtime Instrumentation (slow code): No

See http://www.rsyslog.com for more information.

# rsyslog v5 configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html

# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES #### # 模块放在开头加载

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command) # 可以用来调试，稍后有例子

$ModLoad imklog # provides kernel logging support (previously done by rklogd)

#$ModLoad immark # provides –MARK– message capability

# Provides UDP syslog reception

#$ModLoad imudp

#$UDPServerRun 514

# Provides TCP syslog reception # TCP server，接收端需要加载这个模块，发送端不需要

#$ModLoad imtcp

#$InputTCPServerRun 514

#### GLOBAL DIRECTIVES ####

# Use default timestamp format

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # 消息格式

# File syncing capability is disabled by default. This feature is usually not required,

# not useful and an extreme performance hit

#$ActionFileEnableSync on

#### RULES #### # 用来指定哪种类型的，哪种级别的log，发送给谁处理

# Log all kernel messages to the console.

# Logging much else clutters up the screen.

# kern.* /dev/console

# Log anything (except mail) of level info or higher.

# Don’t log private authentication messages!

*.info;mail.none;authpriv.none;cron.none /var/log/messages

# The authpriv file has restricted access.

authpriv.* /var/log/secure

# Log all the mail messages in one place.

mail.* -/var/log/maillog # ‘-‘ 表示异步

# Log cron stuff

cron.* /var/log/cron

# Everybody gets emergency messages

*.emerg *

# Save news errors of level crit and higher in a special file.

uucp,news.crit /var/log/spooler

# Save boot messages also to boot.log

local7.* /var/log/boot.log # local开头的是自定义的日志类型

# ### begin forwarding rule ###

# The statement between the begin … end define a SINGLE forwarding

# rule. They belong together, do NOT split them. If you create multiple

# forwarding rules, duplicate the whole block!

# Remote Logging (we use TCP for reliable delivery)

#

# An on-disk queue is created for this action. If the remote host is

# down, messages are spooled to disk and sent when it is up again.

#$WorkDirectory /var/lib/rsyslog # where to place spool files

#$ActionQueueFileName fwdRule1 # unique name prefix for spool files

#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)

#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown

#$ActionQueueType LinkedList # run asynchronously

#$ActionResumeRetryCount -1 # infinite retries if host is down

# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional

#*.* @@remote-host:514

# ### end of the forwarding rule ###

# Finally include all config files in /etc/rsyslog.d. This allows overrides

# of the default configuration above.

$IncludeConfig /etc/rsyslog.d/*.conf # 这里会自动加载自定义的*.conf配置文件，可以覆盖默认参数

$InputFileName /path/to/file # 待监控的文件路径

$InputFileTag tag # 文件唯一标识tag，最好保持唯一，用于接收端区分原始log文件，可以包含特殊字符，如”:”、”,”等

$InputFileStateFile /path/to/state/file

# 【重要】需要保证发送端唯一，记录读取到哪儿，状态文件保存在$WorkDirectory，默认为 /var/lib/rsyslog

# 如果某个要监控的文件名变化了，一定要重新设置该值

$InputFileFacility facility # log类型，默认local0， local开头的表示自定义类型

$InputFileSeverity severity # log级别：info，warning，默认notice

$InputRunFileMonitor # 启动监控当前的文件，如果忘记这行，则啥事也不会发生

$InputFilePollInterval seconds # 全局设置，默认轮询是10s

$InputFilePersistStateInterval lines # 每多少行更新state文件状态

$InputFileReadMode mode # 官网竟然没这个解释，不过也没用到。。。

$InputFileMaxLinesAtOnce number

# 默认10240，如果在发送端，需要同时监控多个文件，会处理完当前文件特定行后，切换到下一个文件，避免一个文件一直占用处理，导致收集别的文件不及时。

$InputFileBindRuleset ruleset # 属于较高级的设置，可以把这个listener绑定到特点的规则(http://www.rsyslog.com/doc/v5-stable/concepts/multi_ruleset.html)

# For product, total 19 files.

$InputFileName /Data/logs/product/cache-Statistic.log

$InputFileTag product,cache-Statistic

$InputFileSeverity info

$InputFileStateFile state_product_cache-Statistic

$InputFilePersistStateInterval 25000

$InputFileFacility local5

$InputRunFileMonitor

# Log cron stuff

cron.* /var/log/cron

# 记录info到本地messages文件，.none 结尾表示排除掉这些文件类型。

*.info;mail.none;authpriv.none;cron.none /var/log/messages

# 所有为local5的任意级别日志发送到远端514

local5.* @@192.168.56.10:514

auth #pam产生的日志，认证日志

authpriv #ssh,ftp等登录信息的验证信息，认证授权认证

cron #时间任务相关

kern #内核

lpr #打印

mail #邮件

mark(syslog) #rsyslog服务内部的信息,时间标识

news #新闻组

user #用户程序产生的相关信息

uucp #unix to unix copy, unix主机之间相关的通讯

local 1~7 #自定义的日志设备

debug #有调式信息的，日志信息最多

info #一般信息的日志，最常用

notice #最具有重要性的普通条件的信息

warning, warn #警告级别

err, error #错误级别，阻止某个功能或者模块不能正常工作的信息

crit #严重级别，阻止整个系统或者整个软件不能正常工作的信息

alert #需要立刻修改的信息

emerg, panic #内核崩溃等严重信息

$template <name>,<内容>,<可选项>

$template MyTemplateName,”\7Text %property% some more text\n”,<options>

<接收内容的时间> <发送者的hostname> <$InputFileTag> <原始消息%msg%>

Dec 18 20:39:27 jumper-172-31-56-18 karltestdemoTag blala… dummy msg

%msg%

%syslogfacility%

%HOSTNAME%

%syslogpriority%

%timereported:::date-mysql%

%timegenerated:::date-mysql%

%iut%

‘%syslogtag%’

# For product

$template productFileFormat,”/Data/logs/product/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log”

if $syslogtag startswith ‘product’ then ?productFileFormat;CleanMsgFormat

& ~

$MaxMessageSize 32k

# Provides TCP syslog reception

#$ModLoad imtcp

#$InputTCPServerRun 514

# 修改前

*.info;mail.none;authpriv.none;cron.none /var/log/messages

# Fix后

*.info;mail.none;authpriv.none;cron.none;local5.none;local6.none /var/log/messages

if $syslogtag startswith ‘product’ then ?productFileFormat;CleanMsgFormat

& ~

# 新版本v6之后，变为：

# rsyslogd: warning: ~ action is deprecated, consider using the ‘stop’ statement instead [try http://www.rsyslog.com/e/2307 ]

if $syslogtag startswith ‘product’ then ?productFileFormat;CleanMsgFormat

stop

# For erp_wms

$template erp_wms_FileFormat,”/Data/logs/erp/wms/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log”

if $syslogtag startswith ‘erp_wms’ then ?erp_wms_FileFormat;CleanMsgFormat

& ~

# For erp_wms3

$template erp_wms3_FileFormat,”/Data/logs/erp/wms3/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log”

if $syslogtag startswith ‘erp_wms3’ then ?erp_wms3_FileFormat;CleanMsgFormat

& ~

# 这里注意下面的tag的顺序， 一定要让长的tag（erp_wms3）保持在上面，因为他们有共同的前缀(erp_wms)

# For erp_wms3

$template erp_wms3_FileFormat,”/Data/logs/erp/wms3/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log”

if $syslogtag startswith ‘erp_wms3’ then ?erp_wms3_FileFormat;CleanMsgFormat

& ~

# For erp_wms

$template erp_wms_FileFormat,”/Data/logs/erp/wms/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log”

if $syslogtag startswith ‘erp_wms’ then ?erp_wms_FileFormat;CleanMsgFormat

& ~

# 忽略旧的5.8.6的语法

template (name=”ForwardFormat” type=”string” string=”<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME%

%syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%”)

$InputFileName /Data/logs/mqorder/order-mq-aws/database-stat.log

$InputFileTag erp_mqorder-order-mq-aws,database-stat # 长度39

…

$InputFileName /Data/logs/mqorder/order-mq-aws/database-timeout.log

$InputFileTag erp_mqorder-order-mq-aws,database-timeout # 长度42

…

# ### begin forwarding rule ###

$template LongTagForwardFormat,”<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%”

$WorkDirectory /var/lib/rsyslog # where to place spool files

$ActionQueueFileName karlzhou_fwdRule # unique name prefix for spool files

$ActionQueueMaxDiskSpace 5g # 5gb space limit (use as much as possible)

$ActionQueueSaveOnShutdown on # save messages to disk on shutdown

$ActionQueueType LinkedList # run asynchronously

$ActionResumeRetryCount -1 # infinite retries if host is down

local5.* @@rsyslog.karlzhou.org:514;LongTagForwardFormat

# ### end of the forwarding rule ###

/* hardcoded standard templates (used for defaults) */

static uchar template_DebugFormat[] = “\”Debug line with all properties:\nFROMHOST: ‘%FROMHOST%’, fromhost-ip: ‘%fromhost-ip%’, HOSTNAME: ‘%HOSTNAME%’, PRI: %PRI%,\nsyslogtag ‘%syslogtag%’, programname: ‘%programname%’, APP-NAME: ‘%APP-NAME%’, PROCID: ‘%PROCID%’, MSGID: ‘%MSGID%’,\nTIMESTAMP: ‘%TIMESTAMP%’, STRUCTURED-DATA: ‘%STRUCTURED-DATA%’,\nmsg: ‘%msg%’\nescaped msg: ‘%msg:::drop-cc%’\ninputname: %inputname% rawmsg: ‘%rawmsg%’\n\n\””;

static uchar template_SyslogProtocol23Format[] = “\”<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n\””;

static uchar template_TraditionalFileFormat[] = “=RSYSLOG_TraditionalFileFormat”;

static uchar template_FileFormat[] = “=RSYSLOG_FileFormat”;

static uchar template_ForwardFormat[] = “=RSYSLOG_ForwardFormat”;

static uchar template_TraditionalForwardFormat[] = “=RSYSLOG_TraditionalForwardFormat”;

static uchar template_WallFmt[] = “\”\r\n\7Message from syslogd@%HOSTNAME% at %timegenerated% …\r\n %syslogtag%%msg%\n\r\””;

static uchar template_StdUsrMsgFmt[] = “\” %syslogtag%%msg%\n\r\””;

static uchar template_StdDBFmt[] = “\”insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values (‘%msg%’, %syslogfacility%, ‘%HOSTNAME%’, %syslogpriority%, ‘%timereported:::date-mysql%’, ‘%timegenerated:::date-mysql%’, %iut%, ‘%syslogtag%’)\”,SQL”;

static uchar template_StdPgSQLFmt[] = “\”insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values (‘%msg%’, %syslogfacility%, ‘%HOSTNAME%’, %syslogpriority%, ‘%timereported:::date-pgsql%’, ‘%timegenerated:::date-pgsql%’, %iut%, ‘%syslogtag%’)\”,STDSQL”;

static uchar template_spoofadr[] = “\”%fromhost-ip%\””;

/* end templates */

/* smfwd.c

* This is a strgen module for the traditional (network) forwarding format.

*

* Format generated:

* “<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%”

*

* NOTE: read comments in module-template.h to understand how this file

* works!

*

* File begun on 2010-06-01 by RGerhards

*

# tree -I “*gz|*log” /Data/logs/

/Data/logs/

├── gateway

│   ├── 172.31.70.18

│   │   └── archived

│   ├── 172.31.70.19

│   │   └── archived

│   ├── 172.31.70.195

│   │   └── archived

│   ├── 172.31.70.197

│   │   └── archived

│   ├── 172.31.70.198

│   │   └── archived

│   └── 172.31.70.20

│   └── archived

├── product

│   ├── 172.31.70.118

│   │   └── archived

│   ├── 172.31.70.119

│   │   └── archived

│   ├── 172.31.70.23

│   │   └── archived

│   └── 172.31.70.24

│   └── archived

…

# du -sh /Data/logs

271G /Data/logs