linux - rsyslog.conf 文件停止接收日志

Question

我正在开展一个学校项目，以从发送到 splunk 的打印机获取日志。这是一个由几批学生完成的项目。我最初使用的是前一批学生完成的 rsyslog.conf 文件的原始副本，但无法在 Splunk 中检索数据。 我已经将打印机设置为将日志发送到我正在使用的 Linux 服务器的 IP 地址和端口。在 Splunk 中也进行了配置以监听端口 2048。我的主管告诉我，以前的学生完成的副本应该可以工作。

原件:

# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see 
http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

# The imjournal module bellow is now used as a message source instead of 
imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via 
logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 2048

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

$template RemoteLogs,"/var/log/syslog/%HOSTNAME%/%FROMHOST-IP%.log"
*.* ?RemoteLogs

#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually 
not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log


# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# ### end of the forwarding rule ###

由于无法让打印机使用上述配置将日志发送到 Splunk，我上网研究并进行了一些修改，我设法让打印机将日志发送到 Splunk。

修改后的副本:

# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see                 
http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

# The imjournal module bellow is now used as a message source instead of     
imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via 
logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 2048

*$InputUDPServer BindRuleset remote
$UDPServerRun 2048*

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

$template RemoteLogs,"/var/log/syslog/%HOSTNAME%/%FROMHOST-IP%.log"
*.* ?RemoteLogs


#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually     
not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state

**.* action(type="omfwd" target="172.**.***.156" port="2048" protocol="udp"
action.resumeRetryCount="100"
queue.type="linkedList" queue.size="10000")*


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log


# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
*remote host is: 172.**.***.43:2048
*.* @@remote-host:514*
# ### end of the forwarding rule ###

在进行上述修改后，我能够从打印机接收日志到 Splunk。但是，几天后，当我尝试从打印机生成日志时，我在 Splunk 中不再收到新日志。我没有对我一直使用的 rsyslog.conf 文件的修改副本进行任何更改。因此我不明白为什么 Splunk 不再从打印机接收日志。

我将配置更改为另一个端口号，但仍然没有收到来自打印机的新日志，所以我改回端口 2048。我还仔细检查了我是否正确地在打印机的 EWS 和 Splunk 中进行了相应的更改。我一直在研究这个问题，并仔细检查了一整天，但无济于事。

注意:

-2048 是用于从打印机检索日志的端口

-172.** 。 ***.43是打印机的IP地址(代表真实的IP地址，被别的用户说删了，我在真实的配置文件里没有把astrids作为我的IP地址的一部分)

-172.** 。 ***.156是我使用的Linux服务器的IP地址(代表实际IP地址，被另一个用户告知要审查它，我没有把astrids作为我IP地址的一部分放在真实的配置文件中)

-我使用 Linux 服务器作为我的主要工作点，在修改后的副本中我添加了一个段落，其中包含说明我当前 IP 地址(linux 服务器)的目的地，这是打印机停止向我的服务器发送日志的原因吗？我一直在将日志定向到“我自己”-使用与目标主机相同的 Linux 服务器完成的配置-也是 Linux 服务器)

-带星号的文字是我在原文中添加的

-EWS 代表嵌入式网络服务，基本上是打印机的网络门户。

-我如何从打印机触发日志:登录 EWS/登录失败。登录详细信息将发送到 Splunk

Answer 1

您需要解耦 rsyslog 和 splunk，一次只关注一个。

假设:打印机是 172.x.x.43，配置为通过 udp 2048 将系统日志发送到 172.x.x.156。Rsyslog 在 172.x.x.156 上运行并在 udp 2048 上监听。

确认您能够正确地从打印机生成系统日志消息。(来自 172.x.x.156 命令行)

tcpdump -nn | grep 2048

您至少应该看到进入系统的流量。

我会修改 rsyslog.conf 以仅将打印机信息记录到文件中，然后将其丢弃。您目前正在将所有内容放入文件并将所有内容转发给您自己，但是在您没有收听的端口上...

类似于:

if ($fromhost-ip == '172.x.x.43') then {
  action(type="omfile" file="/var/log/remotehosts/printers/%fromhost-ip%.log")
  stop
}

测试 rsyslog 配置是否有错误: rsyslogd -N1如果正常，请重新启动 rsyslogd。

然后您应该配置 splunk 转发器来使用该文件。输入.conf

[monitor:///var/log/remotehosts/printers/*.log]
sourcetype = printer # or whatever