个人知识网

今天终于解决掉了所有遇到的问题，现在将解决方案及遇到的问题在此记录一下，以免遗忘。

这次花费了不少时间，最大的坑是centos6中自带的rsyslog是5.x版本，而官网上早已经发布到了7.x版本，而我一直按7.x文档来学习，真是坑爹啊。

好了，

下面是rsyslog的配置。

配置repo

在/etc/yum.repos.d下新建文件 rsyslog.repo

[rsyslog_v7]
name=Adiscon CentOS-$releasever - local packages for $basearch
baseurl=http://rpms.adiscon.com/v7-stable/epel-$releasever/$basearch
enabled=1
gpgcheck=0
gpgkey=http://rpms.adiscon.com/RPM-GPG-KEY-Adiscon
protect=1

1、打开udp，514端口

vi /etc/rsyslog.conf

注释掉下面两句前面的‘#’号

$ModLoad imudp
$UDPServerRun 514

2、在/etc/rsysconfig.d/下新建文件igame.conf

$EscapeControlCharactersOnReceive off

$template TraditionalFormat2,"%msg%\n"
$template TraditionalFormat3,"%syslogtag% %msg%\n"

        if re_match($syslogtag,'^moon[0-9]+-[a-zA-Z]+.log$') then {
                $ActionFileDefaultTemplate TraditionalFormat2
                $template DynFile2,"/opt/logs/router-log/%syslogtag:R,ERE,1,DFLT:(.*)-.*.log--end%/%timegenerated:1:10:date-rfc3339%/%syslogtag:R,ERE,1,DFLT:.*-(.*).log--end%.log"
                *.* -?DynFile2
                stop
        } else {
                if re_match($syslogtag,'^moon[0-9]+$') then {
                        $ActionFileDefaultTemplate TraditionalFormat3
                        $template DynFile3,"/opt/logs/router-log/moon-alert.log"
                        *.* -?DynFile3
                        stop
                }

        }

$EscapeControlCharactersOnReceive off

这句用来避免log中的’\t’被当做控制命令被转换为#011

logback中的配置

	<appender name="journal" class="ch.qos.logback.classic.net.SyslogAppender">
		<syslogHost>${logback.syslogHost}</syslogHost>
		<port>${logback.syslogPort}</port>
		<facility>LOCAL7</facility>
		<suffixPattern>${MODULE}-journal.log %date [%thread] %logger{0}\(%L\) %p %msg
		</suffixPattern>
	</appender>