2005年1月13日

/etc/syslog-ng/syslog-ng.conf

特別注意:

  1. syslog-ng 預設是將訊息全部寫入 /var/log/messages 這個檔案,以下的設定會嘗試建立一個 /var/log/messages/ 的目錄,因此 /var/log/messages 這個檔案要先刪除,否則 syslog-ng 就不會啟動!
  2. 以下的設定會在 /var/log 下建立多個目錄,並以 $YEAR$MONTH$DAY.log 為檔案建立每一日的記錄檔,因此要記得整理、刪除不要的檔案!
# $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo,v 1.4 2004/07/18 02:25:02 dragonheart Exp $
#
# Syslog-ng default configuration file for Gentoo Linux
# contributed by Michael Sterrett

options { long_hostnames(off); sync(0);

# The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); create_dirs(yes); };

source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); };

destination messages { file( "/var/log/messages/$YEAR$MONTH$DAY.log" ); };

# By default messages are logged to tty12… destination console_all { file( "/dev/tty12" ); }; # ...if you intend to use /dev/console for programs like xconsole # you can comment out the destination line above that references /dev/tty12 # and uncomment the line below. #destination console_all { file("/dev/console"); };

#log { source(src); destination(messages); }; #log { source(src); destination(console_all); };

#postfix log filter f_postfix { program("postfix"); }; destination d_mail { file( "/var/log/mail/$YEAR$MONTH$DAY.log" ); }; log { source(src); filter(f_postfix); destination(d_mail); };

#driver log filter f_driver { program("drivers/usb/input/"); }; destination d_driver { file( "/var/log/drivers/$YEAR$MONTH$DAY.log" ); }; log { source(src); filter(f_driver); destination(d_driver); };

#POP3 log filter f_pop { program("pop3"); }; destination d_pop { file( "/var/log/pop/$YEAR$MONTH$DAY.log" ); }; log { source(src); filter(f_pop); destination(d_pop); };

#cron log filter f_cron { program("CRON"); }; destination d_cron { file( "/var/log/cron/$YEAR$MONTH$DAY.log" ); }; log { source(src); filter(f_cron); destination(d_cron); };

filter f_cron_daemon { program( "cron" ); }; destination d_cron_daemon { file( "/var/log/cron/daemon-$YEAR$MONTH$DAY.log" ); }; log { source( src ); filter( f_cron_daemon ); destination( d_cron_daemon ); };

#sshd log filter f_sshd { program("sshd"); }; destination d_sshd { file( "/var/log/sshd/$YEAR$MONTH$DAY.log" ); }; log { source(src); filter(f_sshd); destination(d_sshd); };

#spam log filter f_spam { program("spam"); }; destination d_spam { file( "/var/log/spam/$YEAR$MONTH$DAY.log" ); }; log { source(src); filter(f_spam); destination(d_spam); };

#amavisd log filter f_amavisd { program("amavis"); }; destination d_amavisd { file( "/var/log/amavisd/$YEAR$MONTH$DAY.log" ); }; log { source(src); filter(f_amavisd); destination(d_amavisd); };

#dhcpd log filter f_dhcpd { program("dhcpd"); }; destination d_dhcpd { file( "/var/log/dhcpd/$YEAR$MONTH$DAY.log" ); }; log { source(src); filter(f_dhcpd); destination(d_dhcpd); };

#webmin log filter f_webmin { program( "webmin" ); }; destination d_webmin { file( "/var/log/webmin/$YEAR$MONTH$DAY.log" ); }; log { source( src); filter( f_webmin ); destination( d_webmin ); };

#all other log filter f_other { not match( 'ctrl urb status' ); }; log { source(src); filter( f_other ); destination(messages); flags(fallback); };

配合前述的設定檔,每月進行一次 log 檔的整理、壓縮動作。

#!/bin/bash

LOG_DIR="amavisd cron dhcpd mail messages spam sshd webmin" LOG_HOME="/var/log" ARCHIVE_MONTH=$(date -d"1 month ago" +%Y%m) LOG_FILE="/tmp/logArchive.log"

for DIR in $LOG_DIR; do cd $LOG_HOME/$DIR echo "Creating $DIR-$ARCHIVE_MONTH.tar.bz2" >> $LOG_FILE echo "---------------------------------------------------------------" >> $LOG_FILE tar -cjvvf $DIR-$ARCHIVE_MONTH.tar.bz2 $ARCHIVE_MONTH*.log >> $LOG_FILE echo "---------------------------------------------------------------" >> $LOG_FILE echo "Removing $DIR $ARCHIVE_MONTH log files" >> $LOG_FILE rm $ARCHIVE_MONTH*.log echo "===============================================================" >> $LOG_FILE echo >> $LOG_FILE done;

/bin/mailx -s "$ARCHIVE_MONTH archived log files" <系統管理員信箱> < $LOG_FILE