2 taiyang625 Taiyang625 于 2013.07.25 00:17 提问

linux rsyslog 的 rsyslog.conf 配置客户端 缓存问题

现在对客户端的配置修改:

** * **# Remote Logging (we use TCP for reliable delivery)

An on-disk queue is created for this action. If the remote host is

down, messages are spooled to disk and sent when it is up again.

$WorkDirectory /rsyslog/spool # where to place spool files
$ActionQueueFileName uniqName # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown off # save messages to disk on shutdown
$ActionQueueType LinkedList # run asynchronously#$ActionResumeRetryCount -1 # infinite retries if host is down

remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional

. @@remote-host:514** * **

######### Receiving Messages from Remote Hosts ##########

需求:我的客户端长时间与服务器断开,一般不与服务器连接的,只有在需要的时候才连接,估计是1年或者2年后,所以rsyslog 必须保存缓存。我只想保存最近的1g,或者400m什么的,在1g或者400m空间里,产生的新的覆盖旧的,最多永远是1g或者400m.这个配置好像不好弄,

尝试:
服务器断开后,能生存缓存,总共缓存可以达到1g,
但是到了1g后,就不能再缓存日志了,就是写不进去了。
请问:这段如何配置,使达到1g后,又从开始位置文件写,使缓存文件,保存最近的1g日志,新的覆盖旧的,我试了很多办法,都无效,

rsyslog.conf 配置文件内容:

if you experience problems, check

http://www.rsyslog.com/troubleshoot for assistance

rsyslog v3: load input modules

If you do not load inputs, nothing happens!

You may need to set the module load path if modules are not found.

$ModLoad immark # provides --MARK-- message capability
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # kernel logging (formerly provided by rklogd)

Log all kernel messages to the console.

Logging much else clutters up the screen.

#kern.* /dev/console

Log anything (except mail) of level info or higher.

Don't log private authentication messages!

*.info;mail.none;authpriv.none;cron.none -/var/log/messages

The authpriv file has restricted access.

authpriv.* /var/log/secure

Log all the mail messages in one place.

mail.* -/var/log/maillog

Log cron stuff

cron.* -/var/log/cron

Everybody gets emergency messages

*.emerg *

Save news errors of level crit and higher in a special file.

uucp,news.crit -/var/log/spooler

Save boot messages also to boot.log

local7.* /var/log/boot.log

** * **# Remote Logging (we use TCP for reliable delivery)

An on-disk queue is created for this action. If the remote host is

down, messages are spooled to disk and sent when it is up again.

$WorkDirectory /rsyslog/spool # where to place spool files
$ActionQueueFileName uniqName # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown off # save messages to disk on shutdown
$ActionQueueType LinkedList # run asynchronously
$ActionResumeRetryCount -1 # infinite retries if host is down

remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional

. @@remote-host:514** * **

######### Receiving Messages from Remote Hosts ##########

TCP Syslog Server:

provides TCP syslog reception and GSS-API (if compiled to support it)

#$ModLoad imtcp.so # load module
#$InputTCPServerRun 514 # start up TCP listener at port 514

UDP Syslog Server:

#$ModLoad imudp.so # provides UDP syslog reception
#$UDPServerRun 514 # start a UDP syslog server at standard port 514

Csdn user default icon
上传中...
上传图片
插入图片
准确详细的回答,更有利于被提问者采纳,从而获得C币。复制、灌水、广告等回答会被删除,是时候展现真正的技术了!