在Redhat 6.0以后版本的系统日志由原来的syslog升级为rsyslog。
1.rsyslog优势:
RSYSLOG is the rocket-fast system for log processing.
It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of swiss army knife of logging, being able to accept inputs from a wide variety of sources, transform them, and output to the results to diverse destinations.
RSYSLOG can deliver over one million messages per second to local destinations when limited processing is applied (based on v7, December 2013). Even with remote destinations and more elaborate processing the performance is usually considered "stunning".
RSYSLOG:
- Multi-threading
- TCP, SSL, TLS, RELP
- MySQL, PostgreSQL, Oracle and more
- Filter any part of syslog message
- Fully configurable output format
- Suitable for enterprise-class relay chains
2.Rsyslog中配置接收Haproxy日志
修改haproxy的配置文件:
# more haproxy.cfg
# this config needs haproxy-1.1.28 or haproxy-1.2.1
global
log 127.0.0.1 local3
maxconn 1000
pidfile /data/haproxy/logs/haproxy.pid
daemon
nbproc 1
修改rsyslog的配置文件:
# vi /etc/rsyslog.conf
# rsyslog v5 configuration file
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html
#### MODULES ####
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
#$ModLoad immark # provides --MARK-- message capability
# Provides UDP syslog reception
$ModLoad imudp -------默认是没有开启的
$UDPServerRun 514 -------默认是没有开启的
# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514
修改SYSLOGD_OPTION的文件:
vi /etc/sysconfig/rsyslog
# Options for rsyslogd
# Syslogd options are deprecated since rsyslog v3.
# If you want to use them, switch to compatibility mode 2 by "-c 2"
# See rsyslogd(8) for more details
SYSLOGD_OPTIONS="-r -m 0"
重新启动rsyslog进程:
service rsyslog restart
验证已经产生haproxy日志:
Jun 10 22:04:23 localhost haproxy[9417]: Proxy http_server started.
Jun 10 22:04:23 localhost haproxy[9417]: Proxy info_cache started.
Jun 10 22:04:23 localhost haproxy[9417]: Proxy admin_stat started.
Jun 10 22:42:24 localhost haproxy[9418]: 192.168.1.9:54030 [10/Jun/2014:22:41:56.920] http_server info_cache/wget 9/0/2/4/27123 200 601 - - CD-- 0/0/0/0/0 0/0 "GET /test/test.jsp HTTP/1.1"
完成!