Centos7搭建日志服务器rsyslog+loganalyzer

今天药忘吃喽~ 2021-12-13 04:35 809阅读 0赞

一、系统环境

Rsyslog Server OS：CentOS 7

Rsyslog Server IP：172.28.194.118

Rsyslog Version: rsyslog-7.4.7-12.el7.x86\_64

LogAnalyzer Version: loganalyzer-4.1.7.tar.gz

rsyslog-8.24.0-12.el7.x86\_64（centos7默认安装）

二、准备环境

2.1  关闭防火墙：

\#systemctl stop firewalld  
2.2 将SELINUX设置为disabled  
setenforce 0  
sed -i ‘s\#SELINUX=enforcing\#SELINUX=disabled\#g’ /etc/selinux/config

三、配置LAMP环境

3.1 配置LAMP

yum -y install httpd mysql\* php\*

mkdir /home/rsyslog\_server/tools -p （创建下载文件存放目录）

cd /home/rsyslog\_server/tools

yum install wget -y

wget http://dev.mysql.com/get/mysql57-community-release-el7-8.noarch.rpm

rpm -Uvh mysql57-community-release-el7-8.noarch.rpm （安装mysql官方yum仓库）

yum install mysql-community-server -y

systemctl start mysqld.service

systemctl status mysqld.service

grep ‘temporary password’ /var/log/mysqld.log （查看初始密码，记录好初始密码，红色圈文字为初始密码）

![1694241-20190521144050220-254519616.png][]

mysql -u root -p

提示输入密码：输入刚才查看的初始密码

![1694241-20190521144128237-1062585439.png][]

输入密码号，再修改密码，如下命令！

ALTER USER 'root'@'localhost' IDENTIFIED BY 'Lanqing@123'; （修改密码）

3.2 配置Apache和PHP

yum install httpd -y

yum install php php-gd php-xml php-mysql -y

3.3 启动服务并加入开机自启动：

systemctl start httpd.service

systemctl enable httpd.service

systemctl start mysqld.service

systemctl enable mysqld.service

3.4 测试PHP环境  
\[root@localhost ~\]\# cd /var/www/html/  
\[root@localhost html\]\# vim index.php

<?php

phpinfo();

打开浏览器访问：[http://172.28.194.118/index.php][http_172.28.194.118_index.php]

![1694241-20190521144311045-354034981.png][]

四、安装服务器端软件

4.1 检查是否安装了rsyslog软件

rpm -qa|grep rsyslog

4.2 安装rsyslog 连接MySQL数据库的模块

yum install rsyslog-mysql –y

五、配置服务器端

5.1 导入rsyslog-mysql 数据库文件

cd /usr/share/doc/rsyslog-8.24.0

mysql -uroot -p<mysql-createDB.sql

5.2 登录数据库查看

mysql -uroot –p

![1694241-20190521144329900-1774005801.png][]

![1694241-20190521144408562-435802313.png][]

5.3 在MySQL下创建rsyslog用户并授权：

mysql> grant all on Syslog.\* to rsyslog@‘localhost’ identified by 'Lanqing@123'

mysql> flush privileges;

mysql> exit

5.4 配置服务端支持rsyslog-mysql 模块，并开启UDP服务端口获取网内其他LINUX系统日志；

以下为重点需要修改的地方！!!!!

vi /etc/rsyslog.conf

![1694241-20190521144532272-1838692102.png][]

![1694241-20190521144644861-1095218784.png][]

*\# Provides UDP syslog reception*

$ModLoad imudp

$UDPServerRun 514

\# Provides TCP syslog reception

$ModLoad imtcp

$InputTCPServerRun 514

$ModLoad ommysql

\*.\* :ommysql:localhost,Syslog,rsyslog,Vxichina@123

\# Use default timestamp format

$ActionFileDefaultTemplate RSYSLOG\_TraditionalFileFormat

$template Remote,"/var/log/data/%fromhost-ip%/%fromhost-ip%\_%$YEAR%-%$MONTH%-%$DAY%.log"

:fromhost-ip, !isequal, "127.0.0.1" ?Remote

\#Standard Redhat syslog settings

.info;mail.none;authpriv.none;cron.none /var/log/messages

authpriv. /var/log/secure

mail.\* -/var/log/maillog

cron.\* /var/log/cron

.emerg \*

uucp,news.crit /var/log/spooler

\# Save boot messages also to boot.log

local7.\*                                                /var/log/boot.log

$template MySQLInsert,"insert into SystemEvents (Message, Facility, FromHost,Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%fromhost-ip%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL

客户端配置：（服务端可以不配置）

再末尾添加服务器IP地址（接收日志的服务器IP）

\#vi /etc/rsyslog.conf  
*\*.\* @172.28.194.118*

*![loading.gif][]*

vi /etc/bashrc

在文件尾部增加一行

export PROMPT\_COMMAND=’\{ msg=$(history 1 | \{ read x y; echo KaTeX parse error: Expected 'EOF', got '\}' at position 4: y; \}̲);logger "\[euid…(whoami)\]":(whoami):\[‘pwd‘\]" (who am i):\[\`pwd\`\]"(whoami):\[‘pwd‘\]"msg"; \}’

\#source /etc/bashrc  -----------------使其生效

六、安装LogAnalyzer

cd /home/rsyslog\_server/tools/

wget http://download.adiscon.com/loganalyzer/loganalyzer-4.1.7.tar.gz

tar zxf loganalyzer-4.1.7.tar.gz

cd loganalyzer-4.1.7

mkdir -p /var/www/html/loganalyzer

cp -rf src/\* /var/www/html/loganalyzer/

cp -rf contrib/\* /var/www/html/loganalyzer

重启服务

systemctl restart rsyslog.service

systemctl start mysqld.service

systemctl start httpd.service

七、在浏览器中进行安装LogAnalyzer  
7.1 输入http://172.28.194.118/loganalyzer/，点击here

![1694241-20190521145019337-1713461010.png][]

![1694241-20190521145046888-1140060361.png][]

![1694241-20190521145128338-1853073390.png][]

!!!\*\*\*File does NOT exist!！\*\*\*！！！！！！！！！！

提示错误：缺少config.php 文件，并且权限要设置为666，可以使用contrib目录下的configure.sh 脚本生成。

需要在/var/www/html/loganalyzer/ 下创建config.php 文件，可以通过configure.sh文件生成

cd /var/www/html/loganalyzer/

sh configure.sh

![1694241-20190521145154303-1868331934.png][]

刷新网页恢复正常，点击next！！

![1694241-20190521145239239-1933860893.png][]

按照下图修改，一定要注意不要修改错了。

![1694241-20190521145636983-1119780047.png][]

![1694241-20190521145701817-1607355026.png][]

![1694241-20190521145727790-1985281612.png][]

设置管理账号密码！！！！

![1694241-20190521145800414-828883398.png][]

**这里** **SystemEvents   S****和** **E** **是大写的，****S****和****E****一定要大写！！！！**，下图的是小的events 有问题。

![1694241-20190521145845990-1036712349.png][]

![1694241-20190521145917446-769099293.png][]

![1694241-20190521145946986-1905535796.png][]

![1694241-20190521150102319-1538912002.png][]

——————————————配置完成—————————————————————

转载于:https://www.cnblogs.com/lanqing/p/10899867.html

[1694241-20190521144050220-254519616.png]: /images/20211210/db793f615a3c46b7ae1109acd9dab90d.png
[1694241-20190521144128237-1062585439.png]: /images/20211210/1d1d9e63c36940d5bdd523dbcfbcf4e5.png
[http_172.28.194.118_index.php]: http://172.28.194.118/index.php
[1694241-20190521144311045-354034981.png]: /images/20211210/1db73bc32b674ed68ba62a0df4cb126e.png
[1694241-20190521144329900-1774005801.png]: /images/20211210/ea87e338b93d4aff880a44134fb5b45d.png
[1694241-20190521144408562-435802313.png]: /images/20211210/863d64772dbb4836b18bac0b614bbcc7.png
[1694241-20190521144532272-1838692102.png]: /images/20211210/3817cb54320a4280bc0302bae3dacc91.png
[1694241-20190521144644861-1095218784.png]: /images/20211210/e96e6e13fcc64e81b455cba561b8b78d.png
[loading.gif]: /images/20211210/89235326e30a4961af8e22e935017247.png
[1694241-20190521145019337-1713461010.png]: /images/20211210/ae8fde5e81554f9fbd55764b3142c95c.png
[1694241-20190521145046888-1140060361.png]: /images/20211210/5ff93ccee89e46318f061e13a1886261.png
[1694241-20190521145128338-1853073390.png]: /images/20211210/80bd94c06ebc465884dc5f06f25c0b64.png
[1694241-20190521145154303-1868331934.png]: /images/20211210/6e4da7bb857a4d7e844683c3fce62897.png
[1694241-20190521145239239-1933860893.png]: /images/20211210/fe53fa7055db4ad99e1c408ed2ce5510.png
[1694241-20190521145636983-1119780047.png]: /images/20211210/2ac70583b11549148507a62a2bc69a46.png
[1694241-20190521145701817-1607355026.png]: /images/20211210/a48a2b266bd74b90aff294a04861d476.png
[1694241-20190521145727790-1985281612.png]: /images/20211210/a4a7d650329549ea95e47c2c20cd2ddb.png
[1694241-20190521145800414-828883398.png]: /images/20211210/7b66772a676e4ca3b34b593854bee759.png
[1694241-20190521145845990-1036712349.png]: /images/20211210/80cd4c21c1144910b82509e4a4f409e9.png
[1694241-20190521145917446-769099293.png]: /images/20211210/d2829910b88b44c7b645cb4093afbae6.png
[1694241-20190521145946986-1905535796.png]: /images/20211210/b2210487bb834ac1ab75fc08224999a2.png
[1694241-20190521150102319-1538912002.png]: /images/20211210/d6481b22f80d47c7a33554e4b852fc13.png