# Linux Syslog-ng 轉發和過濾日誌

<span style="color: rgb(0, 0, 0);">**Linux要傳送日誌到OpenObserve時，若安裝<span style="background-color: rgb(241, 196, 15);">AxoSyslog</span>或<span style="background-color: rgb(241, 196, 15);">Syslog-ng在v4.5版以上</span>已經支援OpenObserve模組，若設備太舊無法安裝新版可以使用syslog-ng或rsyslog先送到支援OpenObserve的設備上在進行轉發**</span>

<span style="color: rgb(0, 0, 0);">**中繼Server設定，**</span><span style="color: rgb(0, 0, 0);"><span style="color: #000000;">****編輯`/etc/syslog-ng/syslog-ng.conf`****</span></span>

```
options { keep-hostname(yes);chain_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no);
          dns_cache(no); owner("root"); group("adm"); perm(0640);
          stats(freq(0)); bad_hostname("^gconfd$");
};
##################################################### options內新增keep-hostname(yes); 轉發保留原設備名稱
destination d_openobserve_http {
    openobserve-log(
        url("http://192.168.100.1")
        port(5080)
        organization("default")
        stream("syslog-ng")
        user("root@example.com")
        password("b5wE158wERFTaxe0X")
    );
};


log {
    source(s_src);
    destination(d_openobserve_http);
    flags(flow-control);
};
##################################################### 上面為原本openobserve設定
source s_test {
    udp(ip(192.168.100.100) port(514));
};
log {
    source(s_test);
    destination(d_openobserve_http);
};
##################################################### 新增本機收到 udp 514 port 的log並轉發到openobserve
```

<span style="color: rgb(0, 0, 0);">**客戶端設定**</span>

```
# Destinations
########################
# First some standard logfile
#
destination d_remote {
    udp("192.168.100.99" port(514));
};


# Filters
########################
# Here's come the filter options. With this rules, we can set which 
# message go where.
filter f_no_temp1 {
    not (
        (program("CRON") and message("temp1.sh"))
        or (program("CRON") and message("smart -u"))
        or message("cron:session")
        or (program("systemd-logind") and message("suspend"))
    );
};


# Log paths
########################
log {
    source(s_src);
    filter(f_no_temp1);
    destination(d_remote);
};


```

###### <span style="color: #000000;">**設定轉發目的地中繼Server**</span>

###### <span style="color: rgb(0, 0, 0);">**\####################################**</span>  
<span style="color: rgb(0, 0, 0);">**範例過濾**</span>  
<span style="color: rgb(0, 0, 0);">**因為有設定排程訊息太多**</span>  
<span style="color: rgb(0, 0, 0);">**CRON 訊息包含 "/root/temp1.sh"和"smart -u"**</span>  
<span style="color: rgb(0, 0, 0);">**facility 為"authpriv" 訊息包含 "cron:session"**</span>  
<span style="color: rgb(0, 0, 0);">**systemd-logind 進程 訊息包含 "suspend"**</span>

<span style="color: rgb(0, 0, 0);">**\########################################**</span>  
<span style="color: rgb(0, 0, 0);">**再轉發設定中加入filter，過濾的訊息轉送到Server**</span>