
CentOS 6.8에서 CentOS 7.3으로 마이그레이션한 후 라우터 및 기타 장치에서 로그를 수신할 수 없습니다. 살펴보고 해결 방법을 알려주실 수 있나요? 이 일지는 내 모든 작업이 이 일지에 기초를 두고 있기 때문에 나에게 매우 중요합니다. 매우 감사합니다.
다음 정보는 참고용입니다.
[user@host~]$ rsyslogd -v
rsyslogd 7.4.7, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
Runtime Instrumentation (slow code): No
uuid support: Yes
[User@Host~]$ cat /etc/centos-release
CentOS Linux release 7.3.1611 (Core)
[사용자@호스트~]# ll -dZ /var/log/usb
drwxr-xr-x. root root system_u:object_r:var_log_t:s0 /var/log/usb
[사용자@호스트~]# nc -vu 192.168.0.111 514
Ncat: Version 6.40 ( http://nmap.org/ncat )
Ncat: Connected to 192.168.0.111:514.
[사용자@호스트~]# nc -vu 192.168.0.1 514
Ncat: Version 6.40 ( http://nmap.org/ncat )
Ncat: Connected to 192.168.0.1:514.
[User@Host~]$ ip 라우팅 sh
default via 192.168.0.1 dev enp3s0 proto static metric 100
192.168.0.0/24 dev enp3s0 proto kernel scope link src 192.168.0.111 metric 100
192.168.2.0/24 dev enp0s20u2c2 proto kernel scope link src 192.168.2.113 metric 100
[user@host~]#journalctl --unit=rsyslog
-- Reboot --
Jan 07 01:46:49 host systemd[1]: Starting System Logging Service...
Jan 07 01:46:49 host systemd[1]: Started System Logging Service.
/etc/rsyslog.conf(주석 해제만 해당)
$ModLoad imuxsock
$ModLoad imjournal
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerAddress 192.168.0.111
$UDPServerRun 514
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
/etc/rsyslog.d/networklog.conf
$template router, "/var/log/usb/router/router.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.0.1" -?router
& ~
$template nas, "/var/log/usb/qnap/qnap.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.0.110" -?nas
& ~
$template switch, "/var/log/usb/switch/switch.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.0.2" -?switch
& ~
$template bridge, "/var/log/usb/bridge/bridge.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.5.3" -?bridge
$ ~
$template ap, "/var/log/usb/ap/ap.%$year%%$month%%$day%.log"
: fromhost-ip, isequal, "192.168.0.4" -?ap
$ ~
/etc/sysconfig/iptables
# Generated by iptables-save v1.4.7 on Tue Jul 28 19:40:14 2015
*filter
#:INPUT ACCEPT [229:17291]
#:FORWARD ACCEPT [0:0]
#:OUTPUT ACCEPT [133:14088]
# ssh daemon
-A INPUT -p tcp -i enp0s20u2c2 -d 192.168.2.113 -m state --state NEW,ESTABLISHED,RELATED -m tcp --dport 22 -j ACCEPT
# syslog daemon
-A INPUT -i enp3s0 -d 192.168.0.111 -p udp -m state --state NEW,ESTABLISHED,RELATED -m udp --dport 514 -j ACCEPT
-A OUTPUT -o enp3s0 -s 192.168.0.111 -p udp -m state --state NEW,ESTABLISHED,RELATED -m udp --sport 514 -j ACCEPT
# default DROP rule
-A INPUT -j DROP
COMMIT
# Completed on Tue Jul 28 19:40:14 2015
[user@hostnetworkscript]# 고양이 ifcfg-enp3s0
TYPE=Ethernet
BOOTPROTO=static
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=enp3s0
UUID=6201e661-dfc9-4c1a-aad9-3fc1330d79e4
DEVICE=enp3s0
ONBOOT=yes
IPADDR=192.168.0.111
PREFIX=24
GATEWAY=192.168.0.1
DNS1=8.8.8.8
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes
IPV6_PRIVACY=no
답변1
안녕하세요 라인오프너 입니다.
CentOS 6.8과 CentOS 7.3에는 서로 다른 버전의 rsyslogd가 함께 제공된다는 사실을 발견했습니다. 내 이전 conf 코드가 rsyslog 7에서 작동하지 않는 것 같습니다. 시작하려면 인터넷에 많은 샘플 conf가 있습니다.
디버깅을 시작하려면 service 또는 systemctl을 사용하여 rsyslog를 비활성화하고 다음 명령을 실행하십시오.
/path/to/rsyslogd -N 1 ##### check conf syntax
/path/to/rsyslogd -dn ##### run in debug mode
감사해요