Friday, August 22, 2014

如何避免remote syslog寫入到本機的/var/log/messages?

如題,假設今天log receive server將收集幾十台甚至幾百台裝置的log,預設上rsyslog會將這些裝置的log也同時寫入到本機的/var/log/messages。這是個非常令人感到困擾的一件事,因為本機的log將會被洗版.... 還好這是有方法可以解決的,以下用rsyslog舉個例子:

:fromhost-ip,isequal,"192.168.1.1"                        /var/log/remote.log
:fromhost-ip,isequal,"192.168.1.2"                        /var/log/remote.log
:fromhost-ip,isequal,"192.168.1.3"                        /var/log/remote.log
........
*.info;mail.none;authpriv.none;cron.none               /var/log/messages


192.168.1.1~3的log會寫入到/var/log/remote.log,但同時也會寫入
到/var/log/messages!


解決方法:

:fromhost-ip,isequal,"192.168.1.1"                        /var/log/remote.log
           & ~
:fromhost-ip,isequal,"192.168.1.2"                        /var/log/remote.log
           & ~
:fromhost-ip,isequal,"192.168.1.3"                        /var/log/remote.log
          & ~
........
*.info;mail.none;authpriv.none;cron.none               /var/log/messages

"& ~"能通知rsyslog,當把remote device log寫入到/var/log/remote.log後,就停止接下來的動作,那麼當然remote device log就不會寫入到/var/log/messages囉!