rsyslog 配置问题答案

【问题标题】：Issues with rsyslog configurationrsyslog 配置问题
【发布时间】：2020-06-18 23:50:13
【问题描述】：

我正在尝试通过将我的 conf 文件放在 /etc/rsyslog.d/my.conf 中来配置 RSYSLOG 服务器以从我的另一台机器接收日志

文件：my.conf

source s_net { udp(ip(192.168.0.1) port(514)); };
filter VM01{ host( "192.168.0.2" ); };
destination df_VM01 { file("/var/log/my.log"); };
log { source ( s_net ); filter( VM01 ); destination ( df_VM01 ); };

文件：rsyslog.conf：

    # rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

# The imjournal module bellow is now used as a message source instead of imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514


#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log


# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# ### end of the forwarding rule ###

# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

重新启动 rsyslog 服务后，我开始收到以下错误：配置错误：无法解释主配置文件“/etc/rsyslog.conf”。 [v8.24.0-34.el7_6.3 试试http://www.rsyslog.com/e/2207] 在第 1 行或之前解析文件 /etc/rsyslog.d/my.conf 时出错：在第 1 行附近的文件“/etc/rsyslog.d/my.conf”中出现警告

我在网上搜索了错误，它指的是这条消息： “最常见的错误实际上是在引用的行上，或者至少在它前面非常接近”

我没有引用的行，而且我的 Linux 经验很低，这就是为什么我想多学一点，但现在我遇到了这个错误。

有什么想法吗？？？？

【问题讨论】：

标签： linux rsyslog

【解决方案1】：

有什么想法吗？？？？

您的 my.conf 文件似乎使用 syslog-ng 语法，而不是 rsyslog 支持的语法。

这有点难读，但我建议从第 1 页开始并在此处阅读手册：https://www.rsyslog.com/doc/v8-stable/。几年前我自己也这样做过，并从中学到了很多东西。

我已经有一段时间没有阅读它了，但我记得这个资源也很有用：

https://sematext.com/blog/rsyslog-ebook-centralized-logging-with-rsyslog/

【讨论】：