Log centralizzato e fault tolerant con rsyslog
- Con rsyslog, è possibile far loggare un client verso un server centrale. In caso di indisponibilità del server centrale, tramite il modulo relp, il logging verrà conservato in locale, ed alla riconnessione, verrà scritto.
Server
server
sudo apt-get install rsyslog-relp
cat | sudo tee /etc/rsyslog.d/relpserver.conf <<'EOFile' $ModLoad imrelp # Load the input module ('im') 'relp' $InputRELPServerRun 20514 # Set the port to 20514 EOFile
sudo invoke-rc.d rsyslog restart
sudo netstat -anp | grep 20514
tcp 0 0 0.0.0.0:20514 0.0.0.0:* LISTEN 15701/rsyslogd tcp6 0 0 :::20514 :::* LISTEN 15701/rsyslogd
telnet localhost 20514
Trying ::1... Connected to localhost. Escape character is '^]'.
0 serverclose 0 Connection closed by foreign host.
Client
sudo apt-get install rsyslog-relp
cat | sudo tee /etc/rsyslog.d/relpclient.conf <<'EOFile' $ModLoad omrelp $ActionQueueType LinkedList # use asynchronous processing $ActionQueueFileName srvrfwd # set file name, also enables disk mode $ActionResumeRetryCount -1 # infinite retries on insert failure $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
- .* :omrelp:fire.rvmgroup.it:20514;RSYSLOG_ForwardFormat
EOFile
sudo invoke-rc.d rsyslog restart
Test
logger This is a Catalog test