Question

我想从我的客户端服务器发送我的rsyslogs并将其用作我的logstash中的输入，这是我在网上找到的：

在我的客户端上，我将这些行添加到我的rsyslog.conf：

$ModLoad imuxsock

$ModLoad imklog

# Provides UDP forwarding. The IP is the server's IP address
*.* @192.168.1.1:5040 

# Provides TCP forwarding. But the current server runs on UDP
# *.* @@192.168.1.1:5040

并将此行添加到我的服务器：

# provides support for local system logging
$ModLoad imuxsock 

# provides kernel logging support (previously done by rklogd)
$ModLoad imklog

# provides UDP syslog reception. For TCP, load imtcp.
$ModLoad imudp

# For TCP, InputServerRun 514
$UDPServerRun 514

# This one is the template to generate the log filename dynamically, depending on the client's IP address.
$template FILENAME,"/var/log/%fromhost-ip%/syslog.log"

# Log all messages to the dynamically formed file. Now each clients log (192.168.1.2, 192.168.1.3,etc...), will be under a separate directory which is formed by the template FILENAME.
*.* ?FILENAME

并在客户端和服务器上重新启动我的rsyslog，然后在我的logstash中我描述了我的输入：

input {
  tcp {
     port => 5040
     type => syslog
   }
   udp {
     port => 5040
     type => syslog
   }
}

但它没有做任何事情，当我控制+ C时它会向我显示这个错误：

SIGINT received. Shutting down the pipeline. {:level=>:warn}
UDP listener died {:exception=>#<IOError: closed stream>, :backtrace=>["org/jruby/RubyIO.java:3682:in `select'", " ...

我甚至在我的logstash中使用syslog作为输入，但结果是一样的。

input {
  syslog {
    port => 5040
    type => syslog
  }
}

这是我的logstash的输出部分：

output {
  stdout { }
  solr_http {
    solr_url => "http://localhost:8983/solr/logstash_logs"
  }

}

我应该怎么做才能解决它？

Answer 1

问题是因为我的firewalld和iptables！在我禁用它们之后，一切都可以正常工作！

systemctl disable firewalld.service
systemctl disable iptables.service

如何集中rsyslog并将其用作logstash的输入？

1 个答案: