Linux: rsyslog imfile module 應用
分類：Linux_Base
目的： 載入 squid access.log 輸出到遠端 rsyslog server , 使用local7 squid : /etc/rsyslog.d/squid.conf
$ModLoad imfile #provides support for file logging
input( type="imfile" File="/var/log/squid/access.log" Tag="squid" Severity="info" Facility="local7" Ruleset="logsrv")
ruleset(name="logsrv"){
action( type="omfwd" Target="172.16.1.1" Port="514" Protocol="udp")
}
rsyslog server : /etc/rsyslog.d/squid_collect.conf
$template SquidMsg,"%msg:2:$% %fromhost-ip%\n"
if $syslogfacility-text == 'local7' and $programname == 'squid' then {
action(type="omfile" file="/var/log/squid/access.log" template="SquidMsg")
}
syslogfacility-text 對應到 Facility programname 對應到 Tag