Rsyslog  Loganalyzer

 
 
 
一 install
[root@aa-syslog-01 yum.repos.d]# yum install rsyslog rsyslog-mysql mysql-server httpd mod_ssl php php-gd gd php-mysql zlib-devel
 
[root@aa-syslog-01 yum.repos.d]# yum install php-xml php-devel php-mbstring
 
 
二 configure
[root@aa-syslog-01 yum.repos.d]# vim /etc/httpd/conf/httpd.conf
add:
AddType application/x-httpd-php .php
AddType application/x-httpd-php-source .phps
[root@aa-syslog-01 yum.repos.d]# vim /etc/httpd/conf/httpd.conf
add:
index.php
[root@aa-syslog-01 yum.repos.d]# vim /etc/rsyslog.conf
[root@aa-syslog-01 yum.repos.d]# cat /etc/rsyslog.conf
# rsyslog v5 configuration file
 
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html
 
#### MODULES ####
 
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog    # provides kernel logging support (previously done by rklogd)
#$ModLoad immark # provides --MARK-- message capability
$ModLoad ommysql
*.*        :ommysql:localhost,Syslog,root,123456
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
 
# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514
 
 
#### GLOBAL DIRECTIVES ####
 
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
 
# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on
 
# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf
 
 
#### RULES ####
 
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                  /dev/console
 
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                 /var/log/messages
 
# The authpriv file has restricted access.
authpriv.*                                               /var/log/secure
 
# Log all the mail messages in one place.
mail.*                                                   -/var/log/maillog
 
 
# Log cron stuff
cron.*                                                   /var/log/cron
 
# Everybody gets emergency messages
*.emerg                                                  *
 
# Save news errors of level crit and higher in a special file.
uucp,news.crit                                           /var/log/spooler
 
# Save boot messages also to boot.log
local7.*                                                 /var/log/boot.log
 
 
# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$WorkDirectory /var/lib/rsyslog # where to place spool files
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g    # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList    # run asynchronously
#$ActionResumeRetryCount -1     # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# ### end of the forwarding rule ###
[root@aa-syslog-01 yum.repos.d]#
 
 
[root@aa-syslog-01 yum.repos.d]# mysql -uroot -p < /usr/share/doc/rsyslog-mysql-5.8.10/createDB.sql
 
change mysql root(password)
[root@aa-syslog-01 yum.repos.d]# mysqladmin -uroot password '123456'
mysql> grant all on mysql.* to 'root'@'localhost' identified by '123456';
mysql> flush privileges;
 
 
 
[root@aa-syslog-01 yum.repos.d]# mysql -uroot -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 17
Server version: 5.1.61 Source distribution
 
Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
 
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
 
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
 
mysql> show databases;
+--------------------+
| Database            |
+--------------------+
| information_schema |
| Syslog              |
| mysql               |
| test                |
+--------------------+
4 rows in set (0.00 sec)
 
mysql> use Syslog
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
 
Database changed
mysql> show tables;
+------------------------+
| Tables_in_Syslog        |
+------------------------+
| SystemEvents            |
| SystemEventsProperties |
+------------------------+
2 rows in set (0.00 sec)
 
mysql>
 
 
[root@aa-syslog-01 loganalyzer-3.6.2]# cp -R src/ /var/www/html/log
[root@aa-syslog-01 contrib]# cp * /var/www/html/log/
 
[root@aa-syslog-01 log]# chmod +x *.sh
[root@aa-syslog-01 log]# ./configure.sh
[root@aa-syslog-01 log]# chmod 666 config.php
[root@aa-syslog-01 log]# ls
admin                cron         index.php            secure.sh
asktheoracle.php     css          install.php          statistics.php
BitstreamVeraFonts details.php js                    templates
chartgenerator.php doc           lang                 themes
classes              export.php   login.php            userchange.php
config.php           favicon.ico reportgenerator.php
configure.sh         p_w_picpaths       reports.php
convert.php          include      search.php
[root@aa-syslog-01 log]#
[root@aa-syslog-01 html]# chown -R apache.apache log/