RSYSLOG.CONF -- DNS

 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

  cat /etc/rsyslog.conf

 

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

 

[root@ns9-eq log]# vi /etc/rsyslog.conf
[root@ns9-eq log]# systemctl restart rsyslog
[root@ns9-eq log]# systemctl status rsyslog.servoce
 

#### RULES ####

auth,user.*     /var/log/messages
kern.*          /var/log/kern.log
daemon.*        /var/log/daemon.log
syslog.*        /var/log/syslog
mail.*          /var/log/mail.log
named.*         /var/named/chroot/var/log/*.log 
lpr,news,uucp,local0,local1,local2,local3,local4,local5,local6.* /var/log/unused.log
*.* @192.168.130.12

DNS Logs :    named.*     /var/named/chroot/var/log/*.log  

 

 

 

 Fluent d  /etc/td-agent/config.d/worker_0/syslog.conf

<source>
  @type tail
  path /var/named/chroot/var/log/*.log
  pos_file /var/lib/fluent_oci_outplugin/pos/named.pos
  pos_file_compaction_interval 24h
  enable_watch_timer true
  enable_stat_watcher true
  follow_inodes true
  <parse>
    @type none
  </parse>
  format /type=(?<type>[\S]+)\smsg=dnslogs\((?<attrs>[\S]+)\):\s(?<message>.+)/
  tag oci.0.8x8.vo.prod.os.named.*
</source>

 ----

 

<source>
  @type tail
  path /var/log/dns*.log
  pos_file /var/lib/fluent_oci_outplugin/pos/dnslogs.pos
  pos_file_compaction_interval 24h
  enable_watch_timer true
  enable_stat_watcher true
  follow_inodes true
  <parse>
    @type none
  </parse>
  format /type=(?<type>[\S]+)\smsg=dnslogs\((?<attrs>[\S]+)\):\s(?<message>.+)/
  tag oci.0.8x8.vo.prod.os.named.*
</source>
 

 #### RULES ####

auth,user.*     /var/log/messages
kern.*          /var/log/kern.log
daemon.*        /var/log/daemon.log
syslog.*        /var/log/syslog
mail.*          /var/log/mail.log
named.*         /var/log/dns*.log
lpr,news,uucp,local0,local1,local2,local3,local4,local5,local6.* /var/log/unused.log
*.* @192.168.130.12
[root@ns5-eq worker_0]#