日志系统-syslog5424 - RFC5424的slog实现

此包为slog提供了一种格式化结构化消息为syslog 5424格式的途径，以保留结构。输出将写入用户提供的实现Write特质的类型。

有关底层的syslog5424包，请参阅此处。

注意

• 几乎总是应该与slog-async一起使用，以避免降低主线程速度
• 向远程syslog服务器（如InfluxDB）发送时，格式应设置为RFC5425，以包含消息中的长度。理想情况下，还应使用TLS写入器。
• 直接向远程syslog服务器进行日志记录时，您可能会发现slog-retry很有用。

包文档

构建格式化结构：https://docs.rs/syslog5424

slog 实现：https://docs.rs/slog-syslog5424

示例

基本日志记录到stderr

#[macro_use]
extern crate slog;
extern crate slog_syslog5424;

use slog_syslog5424::{Facility, Rfc5424Builder, Rfc5424Writer, WriteFormat};

use slog::Drain;
use std::sync::Mutex;

fn main() {
    let w = std::io::stderr();

    let formatter = Rfc5424Builder::new("enterprise_id", Facility::User)
        .app_name("myapp")
        .expect("invalid app name")
        .hostname("192.0.2.1")
        .expect("invalid hostname")
        .pid("8710")
        .expect("invalid pid")
        .write_format(WriteFormat::RFC5424)
        .build();

    let rfc5424_writer = Rfc5424Writer::new(w, formatter);

    let root = slog::Logger::root(
        Mutex::new(rfc5424_writer).map(slog::Fuse),
        o!("version" => env!("CARGO_PKG_VERSION")),
    );

    info!(root, "service started");
    let sub_log = root.new(o!("address" => "example.com", "port" => "54201"));
    warn!(sub_log, "tls disabled!");
    info!(sub_log, "starting download");
    info!(sub_log, "download complete");
}

记录到InfluxDB

• 下载InfluxDB沙盒： https://github.com/influxdata/sandbox
• 配置telegraf以启用syslog输入
  • 在 sandbox-master/telegraf/telgraf.conf 中：添加以下内容

  [[inputs.syslog]]
    server = "tcp://:6514"
  

  • 在 sandbox-master/docker-compose.yml 中修改暴露给 telegraf 容器的端口

    telegraf:
      # Full tag list: https://hub.docker.com/r/library/telegraf/tags/
      image: telegraf:latest
      environment:
      HOSTNAME: "telegraf-getting-started"
      # Telegraf requires network access to InfluxDB
      links:
      - influxdb
      volumes:
      # Mount for telegraf configuration
      - ./telegraf/:/etc/telegraf/
      # Mount for Docker API access
      - /var/run/docker.sock:/var/run/docker.sock
      ports:
      - "6514:6514/tcp"
      depends_on:
      - influxdb
  

• 启动容器： ./sandbox up
• 修改上一个示例代码以使用 TcpStream 并以RFC5425格式进行格式化

#[macro_use]
extern crate slog;
extern crate slog_syslog5424;

use slog_syslog5424::{Facility, Rfc5424Builder, Rfc5424Writer, WriteFormat};

use slog::Drain;
use std::sync::Mutex;
use std::net::TcpStream;

fn main() {
    let w = TcpStream::connect("127.0.0.1:6514").unwrap();

    let formatter = Rfc5424Builder::new("enterprise_id", Facility::User)
        .app_name("myapp")
        .expect("invalid app name")
        .hostname("192.0.2.1")
        .expect("invalid hostname")
        .pid("8710")
        .expect("invalid pid")
        .write_format(WriteFormat::RFC5425) // telegraf only likes 5425
        .build();

    let rfc5424_writer = Rfc5424Writer::new(w, formatter);

    let root = slog::Logger::root(
        Mutex::new(rfc5424_writer).map(slog::Fuse),
        o!("version" => env!("CARGO_PKG_VERSION")),
    );

    info!(root, "service started");
    let sub_log = root.new(o!("address" => "example.com", "port" => "54201"));
    warn!(sub_log, "tls disabled!");
    info!(sub_log, "starting download");
    info!(sub_log, "download complete");
}