linux - 如何集中 rsyslogs 并用作 logstash 的输入？

Question

我想从我的客户端服务器发送我的 rsyslogs 并将它们用作我的 logstash 中的输入，这是我在网上找到的:

在我的客户端上，我将这行添加到我的 rsyslog.conf 中:

$ModLoad imuxsock

$ModLoad imklog

# Provides UDP forwarding. The IP is the server's IP address
*.* @192.168.1.1:5040 

# Provides TCP forwarding. But the current server runs on UDP
# *.* @@192.168.1.1:5040

并将此行添加到我的服务器:

# provides support for local system logging
$ModLoad imuxsock 

# provides kernel logging support (previously done by rklogd)
$ModLoad imklog

# provides UDP syslog reception. For TCP, load imtcp.
$ModLoad imudp

# For TCP, InputServerRun 514
$UDPServerRun 514

# This one is the template to generate the log filename dynamically, depending on the client's IP address.
$template FILENAME,"/var/log/%fromhost-ip%/syslog.log"

# Log all messages to the dynamically formed file. Now each clients log (192.168.1.2, 192.168.1.3,etc...), will be under a separate directory which is formed by the template FILENAME.
*.* ?FILENAME

并在客户端和服务器上重新启动我的 rsyslog，然后在我的 logstash 中我这样描述我的输入:

input {
  tcp {
     port => 5040
     type => syslog
   }
   udp {
     port => 5040
     type => syslog
   }
}

但它没有做任何事情，当我执行 control + C 时，它会向我显示此错误:

SIGINT received. Shutting down the pipeline. {:level=>:warn}
UDP listener died {:exception=>#<IOError: closed stream>, :backtrace=>["org/jruby/RubyIO.java:3682:in `select'", " ...

我什至在我的 logstash 中使用 syslog 作为输入，但结果是一样的。

input {
  syslog {
    port => 5040
    type => syslog
  }
}

这是我的 logstash 的输出部分:

output {
  stdout { }
  solr_http {
    solr_url => "http://localhost:8983/solr/logstash_logs"
  }

}

我应该怎么做才能修复它？

Answer 1

问题是因为我的 firewalld 和 iptables!在我禁用它们之后，一切正常!

systemctl disable firewalld.service
systemctl disable iptables.service