Shulou(Shulou.com)05/31 Report--

This article introduces you how to understand syslog-ng, the content is very detailed, interested friends can refer to, hope to be helpful to you.

Syslog-ng introduction

Friends who have not used it may not know much about it. Here is an example.

Cat / etc/syslog-ng/syslog-ng.conf

# Syslog-ng configuration file

Options {

Long_hostnames (off)

# long_hostnames (yes | no): is an alias for chain_hostnames and is no longer recommended

Sync (100)

# sync (n): how many lines of information are cached and then written to the file. 0 is not cached, and local parameters can override this value.

Stats (43200)

# stats (n): how long (in seconds) does it take to write two lines of STATUS information? default is: 600.

Create_dirs (yes)

# create_dirs (yes create directory

Compress (yes)

# Compression

Log_fifo_size (200)

# set the size of the output queue

# to prevent the daemon program that sends the log from blocking, syslog-ng has been reading its inward log channel. If the output queue is full, it may cause the loss of log messages. Therefore, setting the size of the output queue is very important, you can set the size of the global output queue, or you can set the size of the output queue for each log message driver.

}

# src

Source src {unix-stream ("/ dev/log"); internal (); pipe ("/ proc/kmsg"); udp (ip (0.0.0.0) port (514);}

# define message source src, which is received from the udp514 port

# Linux an SOCK_STREAM unix socket called / dev/log

# usually, the kernel sends its messages to a special file (BSD system is / dev/kmsg,Linux system is / proc/kmsg)

# internal (); all log messages generated within syslog-ng.

# pipe,fifo opens the specified pipe or FIFO device to read log information

# for realtime alert

Destination d_realtime_alert {udp ("0.0.0.0" port (7777));}

Destination d_realtimepass_alert {udp ("0.0.0.0" port (8888));}

# define the destination d_realtime_alert and send the log message to the specified UDP port 7777

# define the destination d_realtimepass_alert and send the log message to the specified UDP port 8888

Destination d_passport {file ("/ opt/syslog-ng/log/passport_log");}

# write log messages to the specified file

Destination d_maildlogin {udp ("0.0.0.0" port (9801));}

# destination d_maildlogin {file ("/ opt/syslog-ng/log/oplog/$YEAR.$MONTH.$DAY.$HOUR.log" create_dirs (yes));}

# create a file with variables, so that a log file is automatically generated every hour to achieve segmentation

# 192.168.132.203

Filter fallow 192.168.132.203 {host ("192.168.132.203");}

# define a filter to match log messages from 192.168.132.203

Log {source (src); filter (flip 192.168.132.203); destination (d_passport);}

# combine the message source, filter, and message destination to form a complete instruction. Members in the log path are executed sequentially. If it comes from a specified message source, it matches all specified filters and sends it to the specified address.

Destination d_webmail_stat_log {file ("/ opt/syslog-ng/log/oplog/$YEAR.$MONTH.$DAY.$HOUR.log" create_dirs (yes)); udp ("localhost" port (2005)); udp ("localhost" port (2004));}

# record to file and send to UDP port 2005 and 2004

# Webmail Statistic

Filter f_webmail_stat {program ("oplog");}

# program (parm): starts the specified program oplog and sends log messages to the standard input of the process

The above is the receiving log. The sender can be a program or a syslogd that comes with the system.

Cat / etc/syslog.conf

Local6.* @ 192.168.20.85

On how to understand syslog-ng to share here, I hope that the above content can be of some help to you, can learn more knowledge. If you think the article is good, you can share it for more people to see.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.