业务服务器免装插件，使用rsync+nxlog同步+采集应用日志并接入到GrayLog5.1

ssh-keygen -t rsa -b 4096 -C "appserver"
cd /root/.ssh/
cp id_rsa id_rsa_appserver.pem
cat /etc/ssh/sshd_config | grep authorized_keys
cat id_rsa.pub >> /root/.ssh/authorized_keys
sz /root/.ssh/id_rsa_appserver.pem

yum install nfs-utils
showmount -e 192.168.31.140
mkdir /log_collector
mount -t nfs 192.168.31.140:/volume1/LogSpace /log_collector/ -o proto=tcp -o nolock
echo "mount -t nfs 192.168.31.140:/volume1/LogSpace /log_collector/ -o proto=tcp -o nolock" >> /etc/rc.local
chmod a+x /etc/rc.d/rc.local 

/log_collector/var/log/nginx/*.log

mkdir /root/.ssh
cd /root/.ssh/
上传id_rsa_appserver.pem
mkdir /LogSpace
rsync --progress -avz --perms --chmod=ugo+r -og --chown=root:root -e "ssh -p 22 -i /root/.ssh/id_rsa_appserver.pem" root@192.168.31.230:/var/log/nginx/ /LogSpace/
先确认rsync同步是否OK
报错：Permissions 0644 for '/root/.ssh/id_rsa_appserver.pem' are too open.
解决办法：chmod 0600 /root/.ssh/id_rsa_appserver.pem

cat /opt/logfiles_rsync.sh
#!/bin/bash
LOCK=/var/log/appserverlogs_rsync_record.log
echo "同步日期:" >> ${LOCK} 2>&1
echo `date '+%Y-%m-%d_%T'`  >> ${LOCK} 2>&1
echo "================= AppServer logs Rsync starting==============================="   >> ${LOCK} 2>&1
rsync --progress -avz --perms --chmod=ugo+r -og --chown=root:root -e "ssh -p 22 -i /root/.ssh/id_rsa_appserver.pem" root@192.168.31.230:/var/log/nginx/ /LogSpace/ >> ${LOCK} 2>&1
echo "================= AppServer logs Rsync Finished==============================="   >> ${LOCK} 2>&1
#chmod -R 755 /LogSpace/ >> ${LOCK} 2>&1
#chown -R root:root /LogSpace/ >> ${LOCK} 2>&1

crontab -e
添加每1分钟定时同步应用日志到本地
*/59 * * * * /usr/sbin/ntpdate ntp.aliyun.com >> /tmp/ntp_sync.log
*/1 * * * * /opt/logfiles_rsync.sh 

chmod 777 /opt/logfiles_rsync.sh 

yum localinstall nxlog-ce*.rpm

vim /etc/nxlog/nxlog.conf 

1)、运行用户改为root
User root
Group root

2)、Input Output 和Route配置
<Extension _syslog>
    Module      xm_syslog
</Extension>

<Extension _json>
    Module      xm_json
</Extension>
<Input 192.168.31.230_appserver_log>
    Module      im_file
    File        "/LogSpace/*.log"
    SavePos     TRUE
    ReadFromLast TRUE
      <Exec>
           $Hostname = file_name();
           $Message =  $raw_event ;
      </Exec>
</Input>

<Output toGraylog>
    Module      om_udp
    Host        192.168.31.170
    Port        2514
    Exec        to_syslog_bsd();
    Exec        parse_syslog(); to_json();
</Output>
########################################
# Routes                               #
########################################
<Route udproute>
    Path        192.168.31.230_appserver_log => toGraylog
</Route>

systemctl enable nxlog
systemctl start nxlog
systemctl status nxlog

journalctl -xe -u nxlog
tail -f /var/log/nxlog/nxlog.log

https://docs.nxlog.co/userguide/integrate/graylog.html

https://www.mongodb.com/docs/manual/tutorial/configure-scram-client-authentication/

use admin
db.createUser({user: "admin", pwd: "Admin@2023!", roles: ["root"]})
db.auth("admin","Admin@2023!")
#创建graylog数据库并设置密码
use graylog
db.createUser({
   user: "graylog", 
   pwd: "Graylog2023!",
  "roles" : [{
      "role" : "dbOwner",
      "db" : "graylog"
    }, {
      "role" : "readWrite",
      "db" : "graylog"
    }]
})

vim /etc/mongod.conf 
修改如下行
security:
  authorization: enabled

vim /etc/graylog/server/server.conf 
连接配置信息修改成
mongodb_uri = mongodb://graylog:Graylog2023!@localhost/graylog

systemctl restart mongod
systemctl restart graylog-server.service 

mongosh --port 27017  --authenticationDatabase     "admin" -u "admin" -p
mongosh --port 27017  --authenticationDatabase     "graylog" -u "graylog" -p