rsyslog.conf 文件停止接收日志

Question

我正在开展一个学校项目，从发送到 splunk 的打印机获取日志。这是几批学生做的一个项目。我最初使用了上一个批处理学生完成的 rsyslog.conf 文件的原始副本，但无法在 Splunk 中检索数据。 我已经将打印机设置为将日志发送到我正在使用的 linux 服务器的 IP 地址和端口。 Splunk 中的配置也已配置为监听 2048 端口。 我的主管告诉我，之前的学生所做的复制应该可以工作。

原件：

# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see 
http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

# The imjournal module bellow is now used as a message source instead of 
imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via 
logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 2048

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

$template RemoteLogs,"/var/log/syslog/%HOSTNAME%/%FROMHOST-IP%.log"
*.* ?RemoteLogs

#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually 
not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log


# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# ### end of the forwarding rule ###

由于我无法通过上述配置让打印机向 Splunk 发送日志，所以我去网上研究并做了一些修改，我设法让打印机向 Splunk 发送日志。

修改后的副本：

# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see                 
http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

# The imjournal module bellow is now used as a message source instead of     
imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via 
logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 2048

*$InputUDPServer BindRuleset remote
$UDPServerRun 2048*

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

$template RemoteLogs,"/var/log/syslog/%HOSTNAME%/%FROMHOST-IP%.log"
*.* ?RemoteLogs


#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually     
not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state

**.* action(type="omfwd" target="172.**.***.156" port="2048" protocol="udp"
action.resumeRetryCount="100"
queue.type="linkedList" queue.size="10000")*


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log


# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
*remote host is: 172.**.***.43:2048
*.* @@remote-host:514*
# ### end of the forwarding rule ###

在进行上述修改后，我能够将日志从打印机接收到 Splunk。但是，几天后，当我尝试从打印机生成日志时，我在 Splunk 中不再收到新日志。我没有对我一直使用的 rsyslog.conf 文件的修改副本进行任何更改。因此，我不明白为什么 Splunk 不再从打印机接收日志。

我将配置更改为另一个端口号，但仍然没有收到来自打印机的新日志，所以我改回端口 2048。我还仔细检查了我在打印机的 EWS 和 Splunk 中所做的相应更改是否正确。我一直在研究这个并仔细检查了一整天，但无济于事。

注意：

-2048 是用于从打印机检索日志的端口

-172.** 。 ***.43 是打印机的 IP 地址（它代表实际的 IP 地址，被另一个用户告知要审查它，我没有将 astrids 作为我的 IP 地址的一部分放在真实的配置文件中）

-172.** 。 ***.156 是我正在使用的 Linux 服务器的 IP 地址（它代表实际的 IP 地址，被另一个用户告知要对其进行审查，我没有将 astrids 作为我的 IP 地址的一部分放在真实的配置文件中）

-我使用 Linux 服务器作为我的主要工作点，在修改后的副本中我添加了一个段落，其中的目标说明了我当前的 IP 地址（Linux 服务器），这是打印机停止向我的服务器发送日志的原因吗？我一直将日志定向到“我自己”-使用与目标主机相同的 Linux 服务器完成的配置-也是 Linux 服务器）

-带有astrids的文本是我添加到原始副本中的文本

-EWS 代表嵌入式 Web 服务，基本上是打印机的 Web 门户。

-我如何从打印机触发日志：登录 EWS/登录失败。登录详细信息将发送到 Splunk

Answer 1

您需要将 rsyslog 和 splunk 解耦，一次只专注于一个。

假设： 打印机是 172.x.x.43 并配置为通过 udp 2048 将 syslog 发送到 172.x.x.156。 Rsyslog 在 172.x.x.156 上运行，监听 udp 2048。

验证您是否能够正确地从打印机生成系统日志消息。 （来自 172.x.x.156 命令行）

tcpdump -nn | grep 2048

您至少应该看到进入系统的流量。

我会修改 rsyslog.conf 以仅将打印机信息记录到文件中，然后将其丢弃。您目前正在将所有内容放入文件中并将所有内容转发给自己，但在您没有监听的端口上......

类似：

if ($fromhost-ip == '172.x.x.43') then {
  action(type="omfile" file="/var/log/remotehosts/printers/%fromhost-ip%.log")
  stop
}

测试 rsyslog 配置是否有错误： rsyslogd -N1 如果好重启rsyslogd。

然后您应该配置 splunk 转发器以使用该文件。 输入.conf

[monitor:///var/log/remotehosts/printers/*.log]
sourcetype = printer # or whatever