Apache日志配置远程Syslog采集

# Apache日志配置远程Syslog采集

## 1、安装Apache

```bash
[root@localhost ~]# yum install -y httpd
[root@localhost ~]# systemctl start httpd
```

查看httpd日志

```bash
[root@localhost ~]# cd /var/log/httpd
[root@localhost httpd]# ll
total 8
-rw-r--r-- 1 root root 1334 Apr 26 16:03 access_log
-rw-r--r-- 1 root root 1976 Apr 26 16:03 error_log
[root@localhost httpd]# 
```

## 2、初始化日志采集环境

```bash
[root@bigdata05-test ~]# mkdir -v /var/spool/rsyslog
mkdir: created directory ‘/var/spool/rsyslog’
[root@bigdata05-test ~]#
```

## 3、创建Apahce日志文件采集配置

（1）/etc/rsyslog.conf配置文件默认已经开启包含 /etc/rsyslog.d/目录下所有conf类型的文件

```bash
# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf
```

（2）新建Rsyslog的子配置文件

```bash
[root@localhost rsyslog.d]# vim apache-biglog.conf

$ModLoad imfile
$InputFilePollInterval 10
$WorkDirectory /var/spool/rsyslog
$PrivDropToGroup adm

## Apache访问日志文件路径，根据实际情况修改:
$InputFileName /www/wwwlogs/d.com-access_log
$InputFileTag apache-access:
$InputFileStateFile stat-apache-access
$InputFileSeverity info
$InputFilePersistStateInterval 25000
$InputRunFileMonitor

## Apache错误日志文件路径，根据实际情况修改:
$InputFileName /www/wwwlogs/d.com-error_log
$InputFileTag apache-error:
$InputFileStateFile stat-apache-error
$InputFileSeverity error
$InputFilePersistStateInterval 25000
$InputRunFileMonitor

## 指定日志格式模板：
$template BiglogFormatApache,"%msg%\n"

## 注意syslog日志服务器接收地址，根据实际情况修改：
if $programname == 'apache-access' then @10.10.100.166:514;BiglogFormatApache
if $programname == 'apache-access' then ~
if $programname == 'apache-error' then @10.10.100.166:514;BiglogFormatApache
if $programname == 'apache-error' then ~
```

> 注：通过Rsyslog配置日志接收端的时候，如上示例@10.x.x.x:514，用于指定接收日志的服务器的协议、IP地址和端口号。使用@代表走UDP协议，使用@@代表走TCP协议，冒号后面的514代表接收端口。

### 4、重启Rsyslog服务，日志采集开始工作

```bash
[root@localhost rsyslog.d]# systemctl restart rsyslog
[root@localhost rsyslog.d]# systemctl status rsyslog
● rsyslog.service - System Logging Service
   Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: active (running) since 一 2020-07-20 16:24:16 CST; 6s ago
     Docs: man:rsyslogd(8)
           http://www.rsyslog.com/doc/
 Main PID: 70885 (rsyslogd)
   CGroup: /system.slice/rsyslog.service
           └─70885 /usr/sbin/rsyslogd -n

7月 20 16:24:16 localhost.localdomain systemd[1]: Stopped System Logging Service.
7月 20 16:24:16 localhost.localdomain systemd[1]: Starting System Logging Service...
7月 20 16:24:16 localhost.localdomain rsyslogd[70885]:  [origin software="rsyslogd" swVersion="8.24.0-52.el7_8.2" x-pid="708...start
7月 20 16:24:16 localhost.localdomain rsyslogd[70885]: warning: ~ action is deprecated, consider using the 'stop' statement ...307 ]
7月 20 16:24:16 localhost.localdomain rsyslogd[70885]: warning: ~ action is deprecated, consider using the 'stop' statement ...307 ]
7月 20 16:24:16 localhost.localdomain rsyslogd[70885]: rsyslogd's groupid changed to 4
7月 20 16:24:16 localhost.localdomain systemd[1]: Started System Logging Service.
Hint: Some lines were ellipsized, use -l to show in full.
```

> 此时可以通过观察系统中的Rsyslog日志，确定是否正常工作。
> cat /var/log/messages |grep rsyslog