目的：
載入 squid access.log 輸出到遠端 rsyslog server , 使用local7
squid : /etc/rsyslog.d/squid.conf
|
1 2 3 4 5 |
$ModLoad imfile #provides support for file logging input( type="imfile" File="/var/log/squid/access.log" Tag="squid" Severity="info" Facility="local7" Ruleset="logsrv") ruleset(name="logsrv"){ action( type="omfwd" Target="172.16.1.1" Port="514" Protocol="udp") } |
rsyslog server : /etc/rsyslog.d/squid_collect.conf
|
1 2 3 4 |
$template SquidMsg,"%msg:2:$% %fromhost-ip%\n" if $syslogfacility-text == 'local7' and $programname == 'squid' then { action(type="omfile" file="/var/log/squid/access.log" template="SquidMsg") } |
syslogfacility-text 對應到 Facility
programname 對應到 Tag