• Syslog4j 개요
• CentOS에서 rsyslog
• syslog4j Client Sample
• syslog4j Server Sample
• 참고 문헌

syslog client와 server를 구현하는 Syslog4j 오픈소스를 정리 합니다.

 

• 홈페이지 : http://www.syslog4j.org/

• 다운로드 : http://www.syslog4j.org/

• 라이선스 : GNU LGPLv2.1

• 플랫폼 : Java

 
 

Syslog4j 개요

---

 

CentOS에서 rsyslog

---

• syslog 데몬 기동/종료

 

 service rsyslog restart
 ps -ef | grep rsyslogd | grep -v grep
 netstat -an | grep 514 | grep -v grep

 

• vi /etc/rsyslog.conf

  • 기타 설정 파일 : /etc/rsyslog.d/*.conf

 

 //--- TCP 514 port로 수신되는 log를 처리하도록 설정
 $ModLoad imtcp
 $InputTCPServerRun 514
 
 //--- UDP 514 port로 수신되는 log를 처리하도록 설정
 $ModLoad imudp
 $UDPServerRun 514
 
 ### $AllowedSender TCP, 172.23.11.59, 172.21.27.196
 ### $AllowedSender TCP, 127.0.0.1, 172.23.11.0/24
 
 //--- local1 서비스(Facility)의 notice 레벨의 메시지를 저장할 파일 위치 지정
 //--- 메시지 레벨에 none을 지정할 경우 어떤 메시지도 저장되지 않습니다.
 //--- facility.severity     /var/log/파일명
 local1.notice                    /var/log/local1log
 
 !telnetd                         //--- telnetd는 데몬 이름임
 *.*				  /var/log/telnetd

 

• 사용 Port

  • TCP : 514 port

  • UDP : 514 port

   
  

• syslog에 로그를 저장하는 linux 명령어

 

 logger "메시지"
 logger -p local1.notice "메시지"    //--- local1. 서비스 종류, notice. 메시지 레벨
 //--- Oct 22 17:24:53 node101 root: 메시지
 
 echo "aaa" > /dev/tcp/127.0.0.1/514
 echo "<10>aaa" > /dev/tcp/127.0.0.1/514

 

• Default syslog 저장 파일

 

 tail -f /var/log/messages

 

• syslog4j를 사용하여 발생한 메시지 로그 샘플

 

 Message from syslogd@192.168.56.1 at Oct 22 17:44:49 ...
  -1>Oct 22 17:44:50 daou-ghkim Information
 Oct 22 17:44:49 192.168.56.1 -1>Oct 22 17:44:50 daou-ghkim Information

 

syslog4j Client Sample

---

• vi /etc/rsyslog.conf

 

 $ModLoad imudp
 $UDPServerRun 514

 

• 방화벽에서 514/udp를 열어 줍니다.

• vi SampleClient.java

 

 package com.jopenbusiness.syslog;
 
 import org.productivity.java.syslog4j.Syslog;
 import org.productivity.java.syslog4j.SyslogConfigIF;
 import org.productivity.java.syslog4j.SyslogIF;
 import org.productivity.java.syslog4j.impl.net.tcp.TCPNetSyslogConfig;
 import org.productivity.java.syslog4j.impl.net.udp.UDPNetSyslogConfig;
 import org.productivity.java.syslog4j.util.SyslogUtility; 
 
 public class SampleClient {
 	private static String name = "notebook";
 	private static String host = "192.168.56.101";
 	private static String protocol = "udp";
 	private static Integer port = 514;
 	
 	public static void main(String[](.md) args) {
 		SyslogConfigIF config = null;
 		SyslogIF client = null;
 		
 		System.out.print("Start syslog client");
 		config = (protocol.equals("tcp")) ? 
                         new TCPNetSyslogConfig(host, port) : new UDPNetSyslogConfig(host, port);
 		client = Syslog.createInstance(name, config);
 		
 		client.info("Information 1");
 		SyslogUtility.sleep(500l);
 		client.info("Information 2");
 		SyslogUtility.sleep(700l);
 		client.info("Information 3");
 	}
 }

 

• Linux의 /var/log/messages 파일에 표시되는 내용

 

 Oct 22 17:18:26 daou-ghkim Information

 

syslog4j Server Sample

---

• SampleServer.java

  • syslog를 받아 파일로 저장하는 Syslog Server 샘플

  • 파일 저장 또는 표준 출력을 지원하는 내장 EventHandler는 사용하지 않음

 

 package com.jopenbusiness.syslog;
 
 import java.io.File;
 import java.io.FileNotFoundException;
 import java.io.FileWriter;
 import java.io.IOException;
 import java.net.SocketAddress;
 
 import org.productivity.java.syslog4j.server.SyslogServer;
 import org.productivity.java.syslog4j.server.SyslogServerConfigIF;
 import org.productivity.java.syslog4j.server.SyslogServerEventIF;
 import org.productivity.java.syslog4j.server.SyslogServerIF;
 import org.productivity.java.syslog4j.server.SyslogServerSessionlessEventHandlerIF;
 import org.productivity.java.syslog4j.server.impl.event.structured.StructuredSyslogServerEvent;
 import org.productivity.java.syslog4j.server.impl.net.tcp.TCPNetSyslogServerConfig;
 import org.productivity.java.syslog4j.server.impl.net.udp.UDPNetSyslogServerConfig;
 import org.productivity.java.syslog4j.util.SyslogUtility;
 
 public class SampleServer implements SyslogServerSessionlessEventHandlerIF {
 	private static final long serialVersionUID = 7364480356656523264L;
 	
 	private static String name = "notebook";
 	private static String host = "127.0.0.1";
 	private static String protocol = "udp";
 	private static Integer port = 1515;
 
 	public static void main(String[](.md) args) {
 		SyslogServerConfigIF config = null;
 		SyslogServerIF server = null;
 
 		System.out.print("Start syslog server");
 		config = (protocol.equals("tcp")) ? 
                         new TCPNetSyslogServerConfig(host, port) : new UDPNetSyslogServerConfig(host, port);
 		config.addEventHandler(new SampleServer());
 		
 		server = SyslogServer.createThreadedInstance(name, config);
 		while (true) {
 			SyslogUtility.sleep(1000l);
 		}
 	}
 	
 	public void initialize(SyslogServerIF syslogserverif) {
 	}
 	
 	public Object sessionOpened(SyslogServerIF syslogServer, SocketAddress socketAddress) {
 		return null;
 	}
 
 	public void event(Object session, SyslogServerIF syslogServer, SocketAddress socketAddress, SyslogServerEventIF event) {
 		event(syslogServer, socketAddress, event);
 	}
 	
 	public void event(SyslogServerIF syslogServer, SocketAddress socketAddress, SyslogServerEventIF event) {
 		String msg = null;
 		File outFile = null;
 		FileWriter fout = null;
 		
 		if (event instanceof StructuredSyslogServerEvent) {
 			msg = "Structure event - " + event.getMessage();
 		} else {
 			msg = SyslogUtility.newString(syslogServer.getConfig(), event.getRaw());
 		}
 		
 		try {
 			outFile = new File("output/SyslogSampleServer.log");
 			fout = new FileWriter(outFile, true);
 			
 			fout.write("msg : " + msg + "\n");
 		} catch (FileNotFoundException e) {
 		} catch (IOException e) {
 		} finally {
 			if (fout != null) {
 				try { fout.close(); } catch (IOException e) { }
 			}
 		}
 	}
 
 	public void exception(Object session, SyslogServerIF syslogServer, SocketAddress socketAddress, Exception exception) {
 		exception(syslogServer, socketAddress, exception);
 	}
 	
 	public void exception(SyslogServerIF syslogServer, SocketAddress socketAddress, Exception exception) {
 	}
 
 	public void sessionClosed(Object session, SyslogServerIF syslogServer, SocketAddress socketAddress, boolean timeout) {
 	}
 
 	public void destroy(SyslogServerIF syslogserverif) {
 	}
 }

 

참고 문헌

---

• How To Install A Centralized RSYSLOG Server and Client in CentOS/RHEL 5 Or 6, 2013.04

• windows의 eventlog를 syslog 서버로 보내기, 2012.10

• CentOS 6: Install Remote Logging Server (rsyslog), 2013.01

• Install Rsyslog and LogAnalyzer on Centos 6, 2013.07

• Logging from Java Applications, 2013.09

• Filter Conditions

 
 

분류: Java

---