试图将syslog-ng转换为rsyslog

我想让nginx直接login到piwik。 我有问题得到rsyslog来接受一些syslog ng语法。 rsyslog文件说syslog-ng conf是兼容的。

source s_nginx_20 { pipe("/var/lib/nginx/access.log" program_override("nginx-access-log")); }; filter f_nginx_20 { match("nginx-access-log" value("PROGRAM")); }; destination d_piwik { program("/path/to/piwik.sh" template("$MSG\n")); }; log { source(s_nginx_20); filter(f_nginx_20); destination(d_piwik); }; 

以上结果是：

 Mar 3 02:05:21 CentOS-65-64-minimal kernel: imklog 5.8.10, log source = /proc/kmsg started. Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="24662" x-info="http://www.rsyslog.com"] start Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd-3000: unknown priority name "log"" [try http://www.rsyslog.com/e/3000 ] Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd: the last error occured in /etc/rsyslog.d/nginx.conf, line 1:"source s_nginx_20 { pipe("/var/lib/nginx/access.log" program_override("nginx-access-log")); };" Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd: warning: selector line without actions will be discarded Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd-3000: unknown priority name "" [try http://www.rsyslog.com/e/3000 ] Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd: the last error occured in /etc/rsyslog.d/nginx.conf, line 4:"filter f_nginx_20 { match("nginx-access-log" value("PROGRAM")); };" Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd: warning: selector line without actions will be discarded Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd-3000: unknown priority name "sh"" [try http://www.rsyslog.com/e/3000 ] Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd: the last error occured in /etc/rsyslog.d/nginx.conf, line 8:"destination d_piwik { program("/home/fsdownload/piwik.sh" template("$MSG\n")); };" Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd: warning: selector line without actions will be discarded Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd-3000: unknown priority name "" [try http://www.rsyslog.com/e/3000 ] Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd: the last error occured in /etc/rsyslog.d/nginx.conf, line 10:"log { source(s_nginx_20); filter(f_nginx_20); destination(d_piwik); };" Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd: warning: selector line without actions will be discarded Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd: the last error occured in /etc/rsyslog.conf, line 31:"$IncludeConfig /etc/rsyslog.d/*.conf" Mar 3 02:05:21 CentOS-65-64-minimal rsyslogd-2124: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2124 ] 

任何帮助或build议，将不胜感激。 configuration代码片段从这里修改： http ： //syshero.org/post/68174083489/nginx-syslog-ing-without-breaking-the-bank-or-patching

关于让piwik与nginx一起工作的信息在这里： https ： //github.com/piwik/piwik/tree/master/misc/log-analytics

• Uwsgiconfiguration – 没有模块叫做网站
• Nginx反向代理服务器没有正确提供caching的主页
• 拒绝在nginx中为特定的url运行脚本
• 在Docker容器上运行的Ghost不会响应来自其他容器的http请求
• 从Apache到Nginx：使用通配符子域进行复杂的重写

 $ModLoad omprog $ActionOMProgBinary /usr/local/bin/piwik.sh $template nginxlog,"%msg%\n" if $syslogtag contains 'nginx' and $syslogfacility-text == 'local6' then :omprog:;nginxlog :syslogtag, contains, "nginx" ~ 

 $ModLoad imfile # needs to be done just once # File 1 $InputFileName /var/lib/nginx/access.log $InputFileTag nginx_log: $InputFileStateFile /var/lib/rsyslog/nginx_statefile1 $InputFileSeverity info $InputFileFacility local7 $InputFilePollInterval 5 $InputRunFileMonitor if $syslogtag contains 'nginx_log' and $syslogfacility-text == 'local7' then ^/path/to/piwik.sh;nginxlog :syslogtag, contains, "nginx_log" ~