我试图使用rsyslog将Mikrotik日志从远程服务器重定向到本地,并使用Ansible将其自动化。
我是/roles/rsyslog/tasks/main.yml
- name: Adding rsyslog filter to redirect Mikrotik messages
  copy: 
    src: "files/10-mikrotik.conf" 
    dest: "/etc/rsyslog.d/10-mikrotik.conf"
  notify: restart rsyslog
  tags: rsyslog这是/roles/rsyslog/files/10-mikrotik.conf:
$template RouterLog, "/var/log/mikrotik.log"
if $fromhost-ip == {{ mikrotik_ip }} then -?RouterLog
& stop这是/roles/rsyslog/defaults/main.yml:
---
mikrotik_ip: "'127.0.0.1'"Rsyslog配置:
# /etc/rsyslog.conf configuration file for rsyslog
#
# For more information install rsyslog-doc and see
# /usr/share/doc/rsyslog-doc/html/configuration/index.html
#################
#### MODULES ####
#################
module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # provides kernel logging support
#module(load="immark")  # provides --MARK-- message capability
# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")
# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")
###########################
#### GLOBAL DIRECTIVES ####
###########################
#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf
###############
#### RULES ####
###############
#
# First some standard log files.  Log by facility.
#
auth,authpriv.*         /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
#cron.*             /var/log/cron.log
daemon.*            -/var/log/daemon.log
kern.*              -/var/log/kern.log
lpr.*               -/var/log/lpr.log
mail.*              -/var/log/mail.log
user.*              -/var/log/user.log
#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info           -/var/log/mail.info
mail.warn           -/var/log/mail.warn
mail.err            /var/log/mail.err
#
# Some "catch-all" log files.
#
*.=debug;\
    auth,authpriv.none;\
    news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail,news.none      -/var/log/messages
#
# Emergencies are sent to everybody logged in.
#
*.emerg             :omusrmsg:*问题是日志文件不是创建的,但我认为它应该使用这个配置文件。我知道在ansible中使用touch是可能的,但我想避免这种情况,因为将来会有更多的rsyslog吐露任务部分变得很大。更有甚者,变量{ mikrotik_ip }不更改为127.0.0.1
我得到这个rsyslog错误:
Nov 14 10:22:06 buster systemd[1]: Started System Logging Service.
Nov 14 10:22:06 buster rsyslogd[5748]: error during parsing file /etc/rsyslog.d/10-mikrotik.conf, on or before line 2: invalid character '{' in expression - is there an invalid escape sequence somewhere?
Nov 14 10:22:06 buster rsyslogd[5748]: error during parsing file /etc/rsyslog.d/10-mikrotik.conf, on or before line 2: invalid character '{' in expression - is there an invalid escape sequence somewhere?
Nov 14 10:22:06 buster rsyslogd[5748]: error during parsing file /etc/rsyslog.d/10-mikrotik.conf, on or before line 2: invalid character '}' in expression - is there an invalid escape sequence somewhere?
Nov 14 10:22:06 buster rsyslogd[5748]: error during parsing file /etc/rsyslog.d/10-mikrotik.conf, on or before line 2: invalid character '}' in expression - is there an invalid escape sequence somewhere?
Nov 14 10:22:06 buster rsyslogd[5748]: error during parsing file /etc/rsyslog.d/10-mikrotik.conf, on or before line 2: syntax error on token 'then' [v8.1901.0 try https://www.rsyslog.com/e/2207 ]
Nov 14 10:22:06 buster rsyslogd[5748]: could not interpret master config file '/etc/rsyslog.conf'. [v8.1901.0 try https://www.rsyslog.com/e/2207 ]我还试图像这样更改10-mikrotik.conf文件:
if $fromhost-ip == {{ mikrotik_ip }} then action(type="omfile" file="/var/log/mikrotik.log")
& stop...and获取这个rsyslog错误:
Nov 14 10:19:59 buster systemd[1]: Starting System Logging Service...
Nov 14 10:19:59 buster systemd[1]: Started System Logging Service.
Nov 14 10:19:59 buster rsyslogd[5571]: error: extra characters in config line ignored: '444' [v8.1901.0]
Nov 14 10:19:59 buster rsyslogd[5571]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd.  [v8.1901.0]你知不知道,我做错什么了?我的10-mikrotik.conf应该是什么样子?
https://stackoverflow.com/questions/58854601
复制相似问题