rsyslog 发送和接收远程日志

# vim /etc/rsyslog.conf
$ModLoad imudp
$UDPServerRun 514

systemctl restart rsyslog

iptables -A INPUT -p udp --dport 514  -j ACCEPT

# -l listen -p source-port -4 ipv4 -u udp
nc -l -p 514 -4 -u

logger "hello logs" --server {{hostname}} --port 514

<5>Sep 15 15:36:00 root: hello logs

# 旧版本语法 

# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList   # run asynchronously
#$ActionResumeRetryCount -1    # infinite retries if host is down
# Facility.Severity *.* 表示所有  @表示传输协议（@表示udp，@@表示tcp），后面是ip和端口。
*.* @@remote-host:514

# 新版本语法
*.* action(type="omfwd" target="192.0.2.1" port="10514" protocol="tcp")
*.* action(type="omfwd" #使用 omfwd udp 和 tcp 转发插件
queue.type="LinkedList"  # 启用 LinkedList 内存队列，queue_type 可以是 direct、linkedlist 或者 fixedarray（它们是内存队列）或者磁盘
action.resumeRetryCount="-1" # 远程主机关闭时重试次数 -1 无限次
queue.size="10000" # 内存中队列的数量，非字节大小，防止峰值
queue.saveonshutdown="on" # 本地主机关闭时，是否保存内存中的队列到磁盘
target="10.43.138.1" Port="10514" Protocol="tcp")

systemctl restart rsyslog

rsyslogd -i /var/run/rsyslog_reindexer.pid -f /home/me/rsyslog_reindexer.conf