我试图设置我的EC2实例（运行亚马逊Linux，据我所知是build立在RHEL 5）转发日志消息到loggentries.com，但没有得到转发。 作为一个完整的检查，我遵循这篇文章中的指示，build立另一个EC2实例作为中央服务器，发现邮件没有收到。 所以我试着在客户机上执行logger -p cron.info TEST ，发现没有添加到/ var / log / cron ！ 有些东西显然不起作用！ 但rsyslogd正在运行：
ps aux | grep rsys
输出
根25362 0.0 0.0 183768 1328？ S1 14:27 0:00 / sbin / rsyslogd -i /var/run/syslogd.pid -c 5
作为参考，这里是rsyslog.conf（现在删除转发的东西，直到我得到它在本地工作）
#### MODULES #### $ModLoad imuxsock.so # provides support for local system logging (eg via logger command) $ModLoad imklog.so # provides kernel logging support (previously done by rklogd) #$ModLoad immark.so # provides --MARK-- message capability # Provides UDP syslog reception #$ModLoad imudp.so #$UDPServerRun 514 # Provides TCP syslog reception #$ModLoad imtcp.so #$InputTCPServerRun 514 #### GLOBAL DIRECTIVES #### # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # File syncing capability is disabled by default. This feature is usually not required, # not useful and an extreme performance hit #$ActionFileEnableSync on #### RULES #### # Log all kernel messages to the console. # Logging much else clutters up the screen. kern.* /dev/console # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* -/var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * # Save news errors of level crit and higher in a special file. uucp,news.crit /var/log/spooler # Save boot messages also to boot.log local7.* /var/log/boot.log
rsyslog.conf唯一需要转发到远程IP地址的是
*.* @@192.0.2.25:514;
关于你的其他问题
我试图在客户端机器上执行logging器-p cron.infotesting，发现没有添加到/ var / log / cron！
确保在更改configuration后重新启动rsyslogd; 您还需要确保/var/log/cron存在。
编辑
为了演示成功的日志条目，我使用rsyslogd -c4 -d启动了rsyslogd -c4 -d ; 这将所有的debugging发送到我的SSH会话。 我将cron.infologging到/var/log/syslog 。 在另一个ssh会话中，我运行logger -p cron.info "my test again" …这是我成功login到/var/log/syslog之前所看到的…
4578.692833385:b6d8fb70: Message from UNIX socket: #3 4578.692906216:b6d8fb70: logmsg: flags 4, from 'Bucksnort', msg Jul 15 10:02:58 mpenning: my test again 4578.692936284:b6d8fb70: Message has legacy syslog format. 4578.692977796:b6d8fb70: main Q: entry added, size now 1 entries 4578.693017277:b6d8fb70: wtpAdviseMaxWorkers signals busy 4578.693079869:b6d8fb70: main Q: EnqueueMsg advised worker start 4578.693117891:b6d8fb70: --------imuxsock calling select, active file descriptors (max 5): 3 5 4578.693210533:b7590b70: main Q: entry deleted, state 0, size now 0 entries 4578.693246128:b7590b70: testing filter, f_pmask 0 4578.693269892:b7590b70: testing filter, f_pmask 255 4578.693296429:b7590b70: Called action, logging to builtin-file 4578.693340007:b7590b70: file to log to: /var/log/syslog 4578.693369336:b7590b70: doWrite, pData->pStrm 0x96b6268, lenBuf 50 4578.693400172:b7590b70: strm 0x96b6268: file 7(syslog) flush, buflen 50 4578.693487314:b7590b70: strm 0x96b6268: file 7 write wrote 50 bytes 4578.693512965:b7590b70: testing filter, f_pmask 0 4578.693530524:b7590b70: testing filter, f_pmask 0 4578.693547988:b7590b70: testing filter, f_pmask 0 4578.693564966:b7590b70: testing filter, f_pmask 0 4578.693581783:b7590b70: testing filter, f_pmask 0 4578.693599197:b7590b70: testing filter, f_pmask 0 4578.693616153:b7590b70: testing filter, f_pmask 0 4578.693632854:b7590b70: testing filter, f_pmask 0 4578.693649647:b7590b70: testing filter, f_pmask 0 4578.693666837:b7590b70: testing filter, f_pmask 0 4578.693683852:b7590b70: testing filter, f_pmask 0 4578.693700593:b7590b70: testing filter, f_pmask 128 4578.693717070:b7590b70: testing filter, f_pmask 0 4578.693734486:b7590b70: testing filter, f_pmask 1 4578.693751624:b7590b70: testing filter, f_pmask 240 4578.693769534:b7590b70: Called action, logging to builtin-pipe 4578.693791155:b7590b70: (/dev/xconsole) 4578.693820288:b7590b70: main Q:Reg/w0: worker IDLE, waiting for work.