$ rsyslogd -version

rsyslogd 5.8.10, compiled with:

FEATURE_REGEXP: Yes

FEATURE_LARGEFILE: No

GSSAPI Kerberos 5 support: Yes

FEATURE_DEBUG (debug build, slow code): No

32bit Atomic operations supported: Yes

64bit Atomic operations supported: Yes

Runtime Instrumentation (slow code): No

See http://www.rsyslog.com for more information.

# rsyslog v5 configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html

# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES #### # 模块放在开头加载

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command) # 可以用来调试，稍后有例子

$ModLoad imklog # provides kernel logging support (previously done by rklogd)

#$ModLoad immark # provides --MARK-- message capability

# Provides UDP syslog reception

#$ModLoad imudp

#$UDPServerRun 514

# Provides TCP syslog reception # TCP server，接收端需要加载这个模块，发送端不需要

#$ModLoad imtcp

#$InputTCPServerRun 514

#### GLOBAL DIRECTIVES ####

# Use default timestamp format

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # 消息格式

# File syncing capability is disabled by default. This feature is usually not required,

# not useful and an extreme performance hit

#$ActionFileEnableSync on

#### RULES #### # 用来指定哪种类型的，哪种级别的log，发送给谁处理

# Log all kernel messages to the console.

# Logging much else clutters up the screen.

# kern.* /dev/console

# Log anything (except mail) of level info or higher.

# Don't log private authentication messages!

*.info;mail.none;authpriv.none;cron.none /var/log/messages

# The authpriv file has restricted access.

authpriv.* /var/log/secure

# Log all the mail messages in one place.

mail.* -/var/log/maillog # '-' 表示异步

# Log cron stuff

cron.* /var/log/cron

# Everybody gets emergency messages

*.emerg *

# Save news errors of level crit and higher in a special file.

uucp,news.crit /var/log/spooler

# Save boot messages also to boot.log

local7.* /var/log/boot.log # local开头的是自定义的日志类型

# ### begin forwarding rule ###

# The statement between the begin ... end define a SINGLE forwarding

# rule. They belong together, do NOT split them. If you create multiple

# forwarding rules, duplicate the whole block!

# Remote Logging (we use TCP for reliable delivery)

#

# An on-disk queue is created for this action. If the remote host is

# down, messages are spooled to disk and sent when it is up again.

#$WorkDirectory /var/lib/rsyslog # where to place spool files

#$ActionQueueFileName fwdRule1 # unique name prefix for spool files

#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)

#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown

#$ActionQueueType LinkedList # run asynchronously

#$ActionResumeRetryCount -1 # infinite retries if host is down

# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional

#*.* @@remote-host:514

# ### end of the forwarding rule ###

# Finally include all config files in /etc/rsyslog.d. This allows overrides

# of the default configuration above.

$IncludeConfig /etc/rsyslog.d/*.conf # 这里会自动加载自定义的*.conf配置文件，可以覆盖默认参数

auth #pam产生的日志，认证日志

authpriv #ssh,ftp等登录信息的验证信息，认证授权认证

cron #时间任务相关

kern #内核

lpr #打印

mail #邮件

mark(syslog) #rsyslog服务内部的信息,时间标识

news #新闻组

user #用户程序产生的相关信息

uucp #unix to unix copy, unix主机之间相关的通讯

local 1~7 #自定义的日志设备

debug #有调式信息的，日志信息最多

info #一般信息的日志，最常用

notice #最具有重要性的普通条件的信息

warning, warn #警告级别

err, error #错误级别，阻止某个功能或者模块不能正常工作的信息

crit #严重级别，阻止整个系统或者整个软件不能正常工作的信息

alert #需要立刻修改的信息

emerg, panic #内核崩溃等严重信息

$template ,<内容>,<可选项>

$template MyTemplateName,"\7Text %property% some more text\n",

<接收内容的时间> <发送者的hostname> <$InputFileTag> <原始消息%msg%>

Dec 18 20:39:27 jumper-172-31-56-18 karltestdemoTag blala... dummy msg

%msg%

%syslogfacility%

%HOSTNAME%

%syslogpriority%

%timereported:::date-mysql%

%timegenerated:::date-mysql%

%iut%

'%syslogtag%'

# For product

$template productFileFormat,"/Data/logs/product/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log"

if $syslogtag startswith 'product' then ?productFileFormat;CleanMsgFormat

& ~

$MaxMessageSize 32k

# Provides TCP syslog reception

#$ModLoad imtcp

#$InputTCPServerRun 514

# 修改前

*.info;mail.none;authpriv.none;cron.none /var/log/messages

# Fix后

*.info;mail.none;authpriv.none;cron.none;local5.none;local6.none /var/log/messages

if $syslogtag startswith 'product' then ?productFileFormat;CleanMsgFormat

& ~

# 新版本v6之后，变为：

# rsyslogd: warning: ~ action is deprecated, consider using the 'stop' statement instead [try http://www.rsyslog.com/e/2307 ]

if $syslogtag startswith 'product' then ?productFileFormat;CleanMsgFormat

stop

# For erp_wms

$template erp_wms_FileFormat,"/Data/logs/erp/wms/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log"

if $syslogtag startswith 'erp_wms' then ?erp_wms_FileFormat;CleanMsgFormat

& ~

# For erp_wms3

$template erp_wms3_FileFormat,"/Data/logs/erp/wms3/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log"

if $syslogtag startswith 'erp_wms3' then ?erp_wms3_FileFormat;CleanMsgFormat

& ~

# 这里注意下面的tag的顺序， 一定要让长的tag（erp_wms3）保持在上面，因为他们有共同的前缀(erp_wms)

# For erp_wms3

$template erp_wms3_FileFormat,"/Data/logs/erp/wms3/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log"

if $syslogtag startswith 'erp_wms3' then ?erp_wms3_FileFormat;CleanMsgFormat

& ~

# For erp_wms

$template erp_wms_FileFormat,"/Data/logs/erp/wms/%fromhost-ip%/%syslogtag:F,44:2%-%$YEAR%%$MONTH%%$DAY%.log"

if $syslogtag startswith 'erp_wms' then ?erp_wms_FileFormat;CleanMsgFormat

& ~

# 忽略旧的5.8.6的语法

template (name="ForwardFormat" type="string" string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME%

%syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%")

$InputFileName /Data/logs/mqorder/order-mq-aws/database-stat.log

$InputFileTag erp_mqorder-order-mq-aws,database-stat # 长度39

...

$InputFileName /Data/logs/mqorder/order-mq-aws/database-timeout.log

$InputFileTag erp_mqorder-order-mq-aws,database-timeout # 长度42

...

# ### begin forwarding rule ###

$template LongTagForwardFormat,"<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%"

$WorkDirectory /var/lib/rsyslog # where to place spool files

$ActionQueueFileName karlzhou_fwdRule # unique name prefix for spool files

$ActionQueueMaxDiskSpace 5g # 5gb space limit (use as much as possible)

$ActionQueueSaveOnShutdown on # save messages to disk on shutdown

$ActionQueueType LinkedList # run asynchronously

$ActionResumeRetryCount -1 # infinite retries if host is down

local5.* @@rsyslog.karlzhou.org:514;LongTagForwardFormat

# ### end of the forwarding rule ###

/* hardcoded standard templates (used for defaults) */

static uchar template_DebugFormat[] = "\"Debug line with all properties:\nFROMHOST: '%FROMHOST%', fromhost-ip: '%fromhost-ip%', HOSTNAME: '%HOSTNAME%', PRI: %PRI%,\nsyslogtag '%syslogtag%', programname: '%programname%', APP-NAME: '%APP-NAME%', PROCID: '%PROCID%', MSGID: '%MSGID%',\nTIMESTAMP: '%TIMESTAMP%', STRUCTURED-DATA: '%STRUCTURED-DATA%',\nmsg: '%msg%'\nescaped msg: '%msg:::drop-cc%'\ninputname: %inputname% rawmsg: '%rawmsg%'\n\n\"";

static uchar template_SyslogProtocol23Format[] = "\"<%PRI%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n\"";

static uchar template_TraditionalFileFormat[] = "=RSYSLOG_TraditionalFileFormat";

static uchar template_FileFormat[] = "=RSYSLOG_FileFormat";

static uchar template_ForwardFormat[] = "=RSYSLOG_ForwardFormat";

static uchar template_TraditionalForwardFormat[] = "=RSYSLOG_TraditionalForwardFormat";

static uchar template_WallFmt[] = "\"\r\n\7Message from syslogd@%HOSTNAME% at %timegenerated% ...\r\n %syslogtag%%msg%\n\r\"";

static uchar template_StdUsrMsgFmt[] = "\" %syslogtag%%msg%\n\r\"";

static uchar template_StdDBFmt[] = "\"insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')\",SQL";

static uchar template_StdPgSQLFmt[] = "\"insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%, '%timereported:::date-pgsql%', '%timegenerated:::date-pgsql%', %iut%, '%syslogtag%')\",STDSQL";

static uchar template_spoofadr[] = "\"%fromhost-ip%\"";

/* end templates */

/* smfwd.c

* This is a strgen module for the traditional (network) forwarding format.

*

* Format generated:

* "<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%"

*

* NOTE: read comments in module-template.h to understand how this file

* works!

*

* File begun on 2010-06-01 by RGerhards

*