# 日志工具-GrayLog [TOC] SD框架的日志接入了graylog，默认还是file模式，可以在config/log.php中改变配置。 你需要自己部署graylog，或者直接通过docker部署。 [这里是graylog的文档](http://docs.graylog.org/en/2.2/) ```php $config['log']['active'] = 'graylog'; $config['log']['log_level'] = \Monolog\Logger::DEBUG; $config['log']['log_name'] = 'SD'; $config['log']['graylog']['udp_send_port'] = 12500; $config['log']['graylog']['ip'] = '127.0.0.1'; $config['log']['graylog']['port'] = '12201'; $config['log']['graylog']['api_port'] = '9000'; $config['log']['graylog']['efficiency_monitor_enable'] = true; $config['log']['file']['log_path'] = '/../../'; $config['log']['file']['log_max_files'] = 15; $config['log']['file']['efficiency_monitor_enable'] = false; ``` udp_send_port是框架开启的udp发送端口，port是graylog的udp接收端口，api_port是graylog提供的api访问端口，graylog默认是开始efficiency_monitor_enable，这个会对sd的访问进行效率监控。 默认访问grayloag是http://localhost:9000。  此外还可以通过graylog做更多的事，比如数据统计，数据分析，结合钉钉机器人做告警系统。 比如搭建完成的例子，一旦服务器出现异常，运维群就会收到信息，而这一切都是由graylog服务器分析日志后调用的和本身的业务服务器没有关系：  ## Docker部署 这里提供一份docker-compose的配置文件，请注意日志所需要的磁盘空间非常的大，这里我们挂载了一个磁盘到了/data目录，将文件存盘到/data目录对应的文件夹下。 ``` version: '2' services: # MongoDB: https://hub.docker.com/_/mongo/ mongodb: image: mongo:3 volumes: - /data/docker/mongodb:/data/db # Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docker.html elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:5.6.3 volumes: - /data/docker/elasticsearch:/usr/share/elasticsearch/data environment: - http.host=0.0.0.0 - transport.host=localhost - network.host=0.0.0.0 # Disable X-Pack security: https://www.elastic.co/guide/en/elasticsearch/reference/5.6/security-settings.html#general-security-settings - xpack.security.enabled=false - "ES_JAVA_OPTS=-Xms512m -Xmx512m" ulimits: memlock: soft: -1 hard: -1 mem_limit: 1g # Graylog: https://hub.docker.com/r/graylog/graylog/ graylog: image: graylog/graylog:2.4.0-1 volumes: - /data/docker/graylog:/usr/share/graylog/data/journal environment: # CHANGE ME! - GRAYLOG_PASSWORD_SECRET=somepasswordpepper # Password: admin - GRAYLOG_ROOT_PASSWORD_SHA2=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918 - GRAYLOG_WEB_ENDPOINT_URI=http://114.55.253.83:9000/api links: - mongodb:mongo - elasticsearch depends_on: - mongodb - elasticsearch ports: # Graylog web interface and REST API - 9000:9000 # Syslog TCP - 514:514 # Syslog UDP - 514:514/udp # GELF TCP - 12201:12201 # GELF UDP - 12201:12201/udp ``` ## Graylog设置Input 启动好Graylog后，需要配置Input，这里注意我们需要选择GelfUdp默认是12201端口。如果一切顺利，防火墙ok的话就能接收到SD发来的日志了。