# 日志工具-GrayLog [TOC] SD框架的日志接入了graylog，默認還是file模式，可以在config/log.php中改變配置。 你需要自己部署graylog，或者直接通過docker部署。 [這里是graylog的文檔](http://docs.graylog.org/en/2.2/) ```php $config['log']['active'] = 'graylog'; $config['log']['log_level'] = \Monolog\Logger::DEBUG; $config['log']['log_name'] = 'SD'; $config['log']['graylog']['udp_send_port'] = 12500; $config['log']['graylog']['ip'] = '127.0.0.1'; $config['log']['graylog']['port'] = '12201'; $config['log']['graylog']['api_port'] = '9000'; $config['log']['graylog']['efficiency_monitor_enable'] = true; $config['log']['file']['log_path'] = '/../../'; $config['log']['file']['log_max_files'] = 15; $config['log']['file']['efficiency_monitor_enable'] = false; ``` udp_send_port是框架開啟的udp發送端口，port是graylog的udp接收端口，api_port是graylog提供的api訪問端口，graylog默認是開始efficiency_monitor_enable，這個會對sd的訪問進行效率監控。 默認訪問grayloag是http://localhost:9000。  此外還可以通過graylog做更多的事，比如數據統計，數據分析，結合釘釘機器人做告警系統。 比如搭建完成的例子，一旦服務器出現異常，運維群就會收到信息，而這一切都是由graylog服務器分析日志后調用的和本身的業務服務器沒有關系：  ## Docker部署 這里提供一份docker-compose的配置文件，請注意日志所需要的磁盤空間非常的大，這里我們掛載了一個磁盤到了/data目錄，將文件存盤到/data目錄對應的文件夾下。 ``` version: '2' services: # MongoDB: https://hub.docker.com/_/mongo/ mongodb: image: mongo:3 volumes: - /data/docker/mongodb:/data/db # Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:5.6.3 volumes: - /data/docker/elasticsearch:/usr/share/elasticsearch/data environment: - http.host=0.0.0.0 - transport.host=localhost - network.host=0.0.0.0 # Disable X-Pack security: https://www.elastic.co/guide/en/elasticsearch/reference/5.6/security-settings.html#general-security-settings - xpack.security.enabled=false - "ES_JAVA_OPTS=-Xms512m -Xmx512m" ulimits: memlock: soft: -1 hard: -1 mem_limit: 1g # Graylog: https://hub.docker.com/r/graylog/graylog/ graylog: image: graylog/graylog:2.4.0-1 volumes: - /data/docker/graylog:/usr/share/graylog/data/journal environment: # CHANGE ME! - GRAYLOG_PASSWORD_SECRET=somepasswordpepper # Password: admin - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918 - GRAYLOG_WEB_ENDPOINT_URI=http://114.55.253.83:9000/api links: - mongodb:mongo - elasticsearch depends_on: - mongodb - elasticsearch ports: # Graylog web interface and REST API - 9000:9000 # Syslog TCP - 514:514 # Syslog UDP - 514:514/udp # GELF TCP - 12201:12201 # GELF UDP - 12201:12201/udp ``` ## Graylog設置Input 啟動好Graylog后，需要配置Input，這里注意我們需要選擇GelfUdp默認是12201端口。如果一切順利，防火墻ok的話就能接收到SD發來的日志了。