变量问题和使用 rsyslog 和 ansible 创建文件

Question

我正在尝试使用 rsyslog 将 Mikrotik 日志从远程服务器重定向到本地，并使用 Ansible 自动执行此操作。

这是/roles/rsyslog/tasks/main.yml：

- name: Adding rsyslog filter to redirect Mikrotik messages
  copy: 
    src: "files/10-mikrotik.conf" 
    dest: "/etc/rsyslog.d/10-mikrotik.conf"
  notify: restart rsyslog
  tags: rsyslog

这是/roles/rsyslog/files/10-mikrotik.conf：

$template RouterLog, "/var/log/mikrotik.log"
if $fromhost-ip == {{ mikrotik_ip }} then -?RouterLog
& stop

这是 /roles/rsyslog/defaults/main.yml ：

---
mikrotik_ip: "'127.0.0.1'"

Rsyslog 配置：

# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html


#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # provides kernel logging support
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")


###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf


###############
#### RULES ####
###############

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*         /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
#cron.*             /var/log/cron.log
daemon.*            -/var/log/daemon.log
kern.*              -/var/log/kern.log
lpr.*               -/var/log/lpr.log
mail.*              -/var/log/mail.log
user.*              -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info           -/var/log/mail.info
mail.warn           -/var/log/mail.warn
mail.err            /var/log/mail.err

#
# Some "catch-all" log files.
#
*.=debug;\
    auth,authpriv.none;\
    news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail,news.none      -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg             :omusrmsg:*

问题是没有创建日志文件，但我相信它应该使用这个配置文件。我知道可以在 ansible 中使用 touch，但我想避免这种情况，因为将来会有更多的 rsyslog 配置任务部分变得很大。 更重要的是，变量 {{ mikrotik_ip }} 不会更改为 127.0.0.1

我收到此 rsyslog 错误：

Nov 14 10:22:06 buster systemd[1]: Started System Logging Service.
Nov 14 10:22:06 buster rsyslogd[5748]: error during parsing file /etc/rsyslog.d/10-mikrotik.conf, on or before line 2: invalid character '{' in expression - is there an invalid escape sequence somewhere?
Nov 14 10:22:06 buster rsyslogd[5748]: error during parsing file /etc/rsyslog.d/10-mikrotik.conf, on or before line 2: invalid character '{' in expression - is there an invalid escape sequence somewhere?
Nov 14 10:22:06 buster rsyslogd[5748]: error during parsing file /etc/rsyslog.d/10-mikrotik.conf, on or before line 2: invalid character '}' in expression - is there an invalid escape sequence somewhere?
Nov 14 10:22:06 buster rsyslogd[5748]: error during parsing file /etc/rsyslog.d/10-mikrotik.conf, on or before line 2: invalid character '}' in expression - is there an invalid escape sequence somewhere?
Nov 14 10:22:06 buster rsyslogd[5748]: error during parsing file /etc/rsyslog.d/10-mikrotik.conf, on or before line 2: syntax error on token 'then' [v8.1901.0 try https://www.rsyslog.com/e/2207 ]
Nov 14 10:22:06 buster rsyslogd[5748]: could not interpret master config file '/etc/rsyslog.conf'. [v8.1901.0 try https://www.rsyslog.com/e/2207 ]

我也尝试像这样更改 10-mikrotik.conf 文件：

if $fromhost-ip == {{ mikrotik_ip }} then action(type="omfile" file="/var/log/mikrotik.log")
& stop

...并收到此 rsyslog 错误：

Nov 14 10:19:59 buster systemd[1]: Starting System Logging Service...
Nov 14 10:19:59 buster systemd[1]: Started System Logging Service.
Nov 14 10:19:59 buster rsyslogd[5571]: error: extra characters in config line ignored: '444' [v8.1901.0]
Nov 14 10:19:59 buster rsyslogd[5571]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd.  [v8.1901.0]

你有什么想法，我做错了什么？我的 10-mikrotik.conf 应该是什么样子？

Answer 1

使用template模块

- name: Adding rsyslog filter to redirect Mikrotik messages
  template: 
    src: "10-mikrotik.conf.j2" 
    dest: "/etc/rsyslog.d/10-mikrotik.conf"
  notify: restart rsyslog
  tags: rsyslog

并将模板10-mikrotik.conf.j2放入templates目录

$ cat /roles/rsyslog/templates/10-mikrotik.conf.j2
$template RouterLog, "/var/log/mikrotik.log"
if $fromhost-ip == {{ mikrotik_ip }} then -?RouterLog
& stop