【Linux syslog】ログに関する設定を行う | おもちエンジニアのブログ

ログの出力
rsyslog
rsyslogの設定ファイル
syslogのファシリティのプライオリティ

ログの出力

エラーがあったり、コンピュータが何かの動作をすると、それらを記録します。周知の通り、それをログと言います。

Linuxではsyslogを使って、ログを管理します。

rsyslog

システムのログを管理するソフトウェアというものは色々あるらしいですが、rsyslogで色々検証してみます。

※個人で取り扱っているのがCentOS8なので、rsyslogという事情もあります。

rsyslogの設定ファイル

設定ファイルは/etc/rsyslog.confに記載されています。大まかな構成は「モジュール」「グローバル設定」「ルール」です。下記も各区切りで区切って記載しています。

[root@localhost ~]# cat /etc/rsyslog.conf |grep -v -e "^s*$" 
# rsyslog configuration file
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# or latest version online at http://www.rsyslog.com/doc/rsyslog_conf.html 
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

[root@localhost ~]# cat /etc/rsyslog.conf |grep -v -e "^s*$"

# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html

# or latest version online at http://www.rsyslog.com/doc/rsyslog_conf.html

# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####
module(load="imuxsock"   # provides support for local system logging (e.g. via logger command)
       SysSock.Use="off") # Turn off message reception via local log socket; 
  # local messages are retrieved through imjournal now.
module(load="imjournal"     # provides access to the systemd journal
       StateFile="imjournal.state") # File to store the position in the journal
#module(load="imklog") # reads kernel messages (the same are read from journald)
#module(load"immark") # provides --MARK-- message capability
# Provides UDP syslog reception
# for parameters see http://www.rsyslog.com/doc/imudp.html
#module(load="imudp") # needs to be done just once
#input(type="imudp" port="514")
# Provides TCP syslog reception
# for parameters see http://www.rsyslog.com/doc/imtcp.html
#module(load="imtcp") # needs to be done just once
#input(type="imtcp" port="514")

#### MODULES ####

module(load="imuxsock" # provides support for local system logging (e.g. via logger command)

SysSock.Use="off") # Turn off message reception via local log socket;

# local messages are retrieved through imjournal now.

module(load="imjournal" # provides access to the systemd journal

StateFile="imjournal.state") # File to store the position in the journal

#module(load="imklog") # reads kernel messages (the same are read from journald)

#module(load"immark") # provides --MARK-- message capability

# Provides UDP syslog reception

# for parameters see http://www.rsyslog.com/doc/imudp.html

#module(load="imudp") # needs to be done just once

#input(type="imudp" port="514")

# Provides TCP syslog reception

# for parameters see http://www.rsyslog.com/doc/imtcp.html

#module(load="imtcp") # needs to be done just once

#input(type="imtcp" port="514")

#### GLOBAL DIRECTIVES ####
# Where to place auxiliary files
global(workDirectory="/var/lib/rsyslog")
# Use default timestamp format
module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")
# Include all config files in /etc/rsyslog.d/
include(file="/etc/rsyslog.d/*.conf" mode="optional")

#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files

global(workDirectory="/var/lib/rsyslog")

# Use default timestamp format

module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")

# Include all config files in /etc/rsyslog.d/

include(file="/etc/rsyslog.d/*.conf" mode="optional")

#### RULES ####
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure
# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog
# Log cron stuff
cron.*                                                  /var/log/cron
# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*
# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler
# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

#### RULES ####

# Log all kernel messages to the console.

# Logging much else clutters up the screen.

#kern.* /dev/console

# Log anything (except mail) of level info or higher.

# Don't log private authentication messages!

*.info;mail.none;authpriv.none;cron.none /var/log/messages

# The authpriv file has restricted access.

authpriv.* /var/log/secure

# Log all the mail messages in one place.

mail.