我只想要rsyslog将日志发送到集中rsyslog服务器，但它也发送到本地。 这是出于法律原因，服务器将不会有日志目录，只有集中的rsyslog服务器将有日志。
我想通过在客户端的rsyslog.conf中使用'＆〜'，它只会远程发送日志，但我错了。
这里是集中的rsyslog服务器configuration：
$ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel logging support (previously done by rklogd) $ModLoad immark # provides --MARK-- message capability module(load="imudp") # needs to be done just once input(type="imudp" port="514") $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $klogConsoleLogLevel 3 $FileOwner root $FileGroup root $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 *.info;*.!warn;\ authpriv.none;cron.none;mail.none;news.none -/var/log/messages *.warn;\ authpriv.none;cron.none;mail.none;news.none -/var/log/syslog *.=debug -/var/log/debug authpriv.* -/var/log/secure cron.* -/var/log/cron mail.* -/var/log/maillog *.emerg :omusrmsg:* uucp,news.crit -/var/log/spooler $template TmplAuth, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log" $template TmplMsg, "/var/log/rsyslog_custom/%HOSTNAME%/%PROGRAMNAME%.log" authpriv.* ?TmplAuth *.info,mail.none,authpriv.none,cron.none ?TmplMsg 这里是客户端configuration：
$ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel logging support (previously done by rklogd) $ModLoad immark # provides --MARK-- message capability $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $klogConsoleLogLevel 3 $FileOwner root $FileGroup root $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 *.info;*.!warn;\ authpriv.none;cron.none;mail.none;news.none -/var/log/messages &~ *.warn;\ authpriv.none;cron.none;mail.none;news.none -/var/log/syslog *.=debug -/var/log/debug authpriv.* -/var/log/secure cron.* -/var/log/cron mail.* -/var/log/maillog *.emerg :omusrmsg:* uucp,news.crit -/var/log/spooler if $syslogfacility-text == 'local6' and $programname == 'httpd' then /var/log/httpd-access.log if $syslogfacility-text == 'local6' and $programname == 'httpd' then ~ if $syslogfacility-text == 'local7' and $programname == 'httpd' then /var/log/httpd-error.log if $syslogfacility-text == 'local7' and $programname == 'httpd' then ~
你可能有语法问题。 尝试使用换行符分隔符编写规则，如下所示：
if $syslogfacility-text == 'local6' and $programname == 'httpd' then /var/log/httpd-access.log & ~
或者甚至更好，你可以使用现代的RainerScript语法，而不是传统的格式：
if ( $syslogfacility-text == 'local6' and $programname == 'httpd' ) then { action(type="omfile" file="/var/log/httpd-access.log") stop }
这是更详细和不太模糊。