Shulou(Shulou.com)06/03 Report--

# Experimental environment # #

Rhel7_node1: 192.168.1.10

Rhel8_node1:192.168.1.11

The log collection tool journald rsyslog Enterprise 7 has these two.

Journald (after Enterprise 7)

Logs are generated by the program itself, and the main function of the systemd-journald.service service is to collect the logs generated by the program according to certain formats and save them to the default path / run/log

Journalctl-o short classic mode, equivalent to the default mode journalctl

The log in / run/log is gone after restart.

Journalctl-vacumm-size=1G settings are temporary and need to be changed permanently by changing the configuration file / etc/systemd/journal.conf

Jounalctl PID=? Conditions can be viewed through journalctl-0 verbose

The second experiment

Rsyslog (this was the only one before Enterprise 7)

Cat files: you can view logs stored in different files

Experiment one

Experiment two

The above two methods can only store logs in the current host, so it is inefficient to store everyone's logs in the same host: remote synchronization of logs.

Remote synchronization of logs

Udp (throw regardless) is faster than tcp (three-way handshake protocol).

The intranet is generally used, so there is no need to consider its stability

Operate in Enterprise 8

test

Timedatectl

Time synchronization service

Synchronize the time in enterprise 8 and enterprise 7

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.