rsyslog日志管理+LogAnalyzer

「爱情、让人受尽委屈。」 2022-01-13 00:19 303阅读 0赞

# 简介RSYSLOG #

用于日志处理系统。它提供高性能，高安全×××和模块化设计。  
支持多线程，TCP，SSL，TLS，RELP  
支持MySQL，PostgreSQL，Oracle数据库

# 配置说明 #

**配置文件格式rsyslog.conf**  
三部分组成：  
MODULES  
GLOBAL DRICTIVES  
RULES

$WorkDirectory /var/lib/rsyslog
    $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
    $IncludeConfig /etc/rsyslog.d/*.conf
    $OmitLocalLogging on
    $IMJournalStateFile imjournal.state
    *.info;mail.none;authpriv.none;cron.none                /var/log/messages
    authpriv.*                                                                 /var/log/secure
    mail.*                                                                      -/var/log/maillog
    cron.*                                                                      /var/log/cron
    *.emerg                                                                   :omusrmsg:*
    uucp,news.crit                                                        /var/log/spooler
    local7.*                                                                   /var/log/boot.log

**日志记录：先分类，后分级**  
authpriv 安全认证相关  
cron at 与cron定时相关  
daemon 后台进程相关  
kern 内核  
lpr 打印系统  
mail 邮件系统 -/var/log/maillog 减号缓存一定量再写入  
syslog 日志服务本身

**指定级别：**  
\*：所有级别；  
none：没有级别；  
priority：此级别以高于此级别的所有级别；  
=priorty：仅此级别；

# 安装 #

yum install rsyslog rsyslog-mysq -y  
yum install httpd mod\_ssl php php-gd php-xml php-mysql -y  
yum install -y mariadb-server

systemctl start httpd.service  
systemctl enable httpd.service

**配置my.cnf**

vim /etc/my.cnf
    [mysqld]
    innodb_file_per_table = 1
    skip_name_resolve=1
    log_bin=mysql-bin

启动mariadb

systemctl start mariadb.service
    systemctl enable mariadb.service

导入rsyslog-mysql 数据库文件

cd /usr/share/doc/rsyslog-8.24.0/
    mysql -uroot -p<mysql-createDB.sql

**创建数据库**

mysql> use Syslog;
    mysql> show databases;
    mysql> show tables;

rsyslog用户并授权

grant all on Syslog.* to rsyslog@'localhost' identified by 'Rsyslog;

**配置服务端支持rsyslog-mysql 模块**

vim /etc/rsyslog.conf                    #按如下进行更改   
    #### MODULES ####    
    $Modload ommysql    
    *.* :ommysql:localhost,Syslog,rsyslog,Rsyslog
    
    $ModLoad immark            # immark是模块名，支持日志标记    
    $ModLoad imudp             # imupd是模块名，支持udp协议    
    $UDPServerRun 514          #允许514端口接收使用UDP和TCP协议转发过来的日志

**安装LogAnalyzer**

wget -c http://download.adiscon.com/loganalyzer/loganalyzer-4.1.7.tar.gz
    tar xf loganalyzer-4.1.7.tar.gz -C /tmp/
    cd /tmp/loganalyzer-4.1.7/
    mkdir -pv /var/www/html/loganalyzer
    cp -a src/* /var/www/html/loganalyzer/
    cp -a contrib/* /var/www/html/loganalyzer/
    chmod +x /var/www/html/loganalyzer/*.sh

./configure.sh 产生config.php文件

**配置LogAnalyzer**  
![rsyslog日志管理+LogAnalyzer][rsyslog_LogAnalyzer]  
![rsyslog日志管理+LogAnalyzer][rsyslog_LogAnalyzer 1]  
![rsyslog日志管理+LogAnalyzer][rsyslog_LogAnalyzer 2]  
![rsyslog日志管理+LogAnalyzer][rsyslog_LogAnalyzer 3]  
![rsyslog日志管理+LogAnalyzer][rsyslog_LogAnalyzer 4]  
![rsyslog日志管理+LogAnalyzer][rsyslog_LogAnalyzer 5]  
![rsyslog日志管理+LogAnalyzer][rsyslog_LogAnalyzer 6]  
![rsyslog日志管理+LogAnalyzer][rsyslog_LogAnalyzer 7]  
![rsyslog日志管理+LogAnalyzer][rsyslog_LogAnalyzer 8]

修改 config.php

$CFG['Sources']['Source1']['DBTableName'] = 'SystemEvents';

修改config.php文件权限644

./secure.sh

![rsyslog日志管理+LogAnalyzer][rsyslog_LogAnalyzer 9]

转载于:https://blog.51cto.com/14074807/2393785

[rsyslog_LogAnalyzer]: https://s1.51cto.com/images/blog/201905/13/f60826a0521cb69c3f226a104792e315.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[rsyslog_LogAnalyzer 1]: https://s1.51cto.com/images/blog/201905/13/ad1c3b664b091af20b1d3125f5ffc091.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[rsyslog_LogAnalyzer 2]: https://s1.51cto.com/images/blog/201905/13/27ca78a47e9dfb37fba3a52d2b0847a1.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[rsyslog_LogAnalyzer 3]: https://s1.51cto.com/images/blog/201905/13/3d5fa54d115b93ef780eb11a66bbd09c.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[rsyslog_LogAnalyzer 4]: https://s1.51cto.com/images/blog/201905/13/9609ba1943453224ec5619ed919f6740.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[rsyslog_LogAnalyzer 5]: https://s1.51cto.com/images/blog/201905/13/adbc4ad36669088c00bc7144164fd6ec.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[rsyslog_LogAnalyzer 6]: https://s1.51cto.com/images/blog/201905/13/7286e60bc33a2293121bd3fb4bd5f00b.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[rsyslog_LogAnalyzer 7]: https://s1.51cto.com/images/blog/201905/13/87d27c17181eac07c6dac24ed42610d4.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[rsyslog_LogAnalyzer 8]: https://s1.51cto.com/images/blog/201905/13/9b1dd178e5ca2b7a7bf28976d446082c.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[rsyslog_LogAnalyzer 9]: https://s1.51cto.com/images/blog/201905/13/4c6201d9051225b9bd6e7a6b6d03a451.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=