linux rsyslog,从/var/log外部的文件收集日志

i2loujxw  于 2023-02-03  发布在  Linux
关注(0)|答案(1)|浏览(229)

我有一些不同的日志被写入到moutend nfs共享,我需要将它们发送到syslog-server(graylog),它们位于/var/log文件夹之外。因此,我在/etc/rsyslog.d/中添加了一些额外的配置文件。

atlassian-application-confluence-log.conf

module(load="imfile")
module(load="imklog")
$MaxMessageSize 50k
global(workDirectory="/atlassian/test/confluence/logs")

# This is the main application log file
input(type="imfile"
File="/atlassian/test/confluence/logs/atlassian-confluence.log"
Tag="atlassian"
PersistStateInterval="200"
)

# This file contains entries related to the search index.
input(type="imfile"
File="/atlassian/test/confluence/logs/atlassian-confluence-index.log"
Tag="atlassian"
PersistStateInterval="200"
)

# Send to Graylog
action(type="omfwd" target="log-server-company.com" port="5140")

# if you want to keep a local copy of the logs.
action(type="omfile" File="/var/log/rsyslog.log" template="RSYSLOG_TraditionalFileFormat")

atlassian应用程序jira-log.conf

module(load="imfile")
module(load="imklog")
$MaxMessageSize 50k

global(workDirectory="/atlassian/test/jira/log")

# Contains logging for most of Jira, including logs that aren’t specifically written elsewhere
input(type="imfile"
File="/atlassian/test/jira/log/atlassian-jira.log"
Tag="atlassian"
PersistStateInterval="200"
)

# Send to Graylog
action(type="omfwd" target="log-server-company.com" port="5140")

# if you want to keep a local copy of the logs.
action(type="omfile" File="/var/log/rsyslog.log" template="RSYSLOG_TraditionalFileFormat")

所以我的问题。当我检查Rsyslogd配置与以下命令:rsyslogd -N1 -f /etc/rsyslog.d/atlassian-application-confluence-log.conf它表示它是有效的。
当我重新启动rsyslog服务时,我收到以下错误:

module 'imfile' already in this config, cannot be added  [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2221 ]
module 'imklog' already in this config, cannot be added  [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2221 ]

error during parsing file /etc/rsyslog.d/atlassian-tomcat-confluence-log.conf, on or before line 6: parameter 'workdirectory' specified more than once - one instance is ignored. Fix config [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2207]>
error during parsing file /etc/rsyslog.d/atlassian-tomcat-confluence-log.conf, on or before line 6: parameter 'workDirectory' not known -- typo in config file? [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2207] 

module 'imfile' already in this config, cannot be added  [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2221 ]
module 'imklog' already in this config, cannot be added  [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2221 ]
[origin software="rsyslogd" swVersion="8.2102.0-10.el8" x-pid="379288" x-info="https://www.rsyslog.com"] start
imjournal: journal files changed, reloading...  [v8.2102.0-10.el8 try https://www.rsyslog.com/e/0 ]

我怎样才能摆脱这些警告呢?我已经尝试过将这两个模块放在/etc/rsyslog.conf中
我从该配置中得到以下错误:参数“PersistStateInterval”未知,参数“Tag”未知,参数“File”未知

ffscu2ro

ffscu2ro1#

如果有多个配置文件,则按文件名的升序(数字/字母顺序)处理,请参阅:$IncludeConfig.
因此你不必多次包含任何配置参数(模块,工作目录,规则集等),你可以在第一次加载的配置中包含它们一次。

相关问题