syslog-ng和logzilla实现日志集中管理

1、安装syslog-ng
#cd /root/pkgs
#wget http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.0.3/setups/rhel-5-i386/syslog-ng-3.0.3-1.rhel5.i386.rpm
#wget http://www.balabit.com/downloads/files/eventlog/0.2/eventlog_0.2.9.tar.gz

#cp eventlog_0.2.9.tar.gz /usr/src/redhat/SOURCES/
#cd /usr/src/redhat/SOURCES/
#tar zxvf eventlog_0.2.9.tar.gz
#cd eventlog-0.2.9/
#rpmbuild --ba eventlog.spec.bb
#cd /usr/src/redhat/RPMS/x86_64
#rpm -Uvh libevtlog*

#cd /root/pkgs/
#rpm -Uvh syslog-ng-3.0.3-1.rhel5.i386.rpm
sysllog-ng软件会安装到/opt/syslog-ng/目录下

2、安装logzilla
#cd /root/pkgs/
#wget http://php-syslog-ng.googlecode.com/files/logzilla_v2.9.9o.tgz
#tar xzvf logzilla_v2.9.9o.tgz
#mkdir -p /var/log/logzilla

3、修改syslog-ng的配置
#cd /opt/syslog-ng/

#vi etc/syslog-ng.conf

@version: 3.0
source s_local {
internal();
unix-stream("/dev/log");
file("/proc/kmsg" program_override("kernel: "));
};
source s_local {
        udp(ip(0.0.0.0) port(514));
};

# destinations        
destination d_messages { file("/var/log/syslog-ng/$HOST"); };        
    
    
###########################################################################################        
# Clay's LogZilla config below        
###########################################################################################        
# Last updated on 2010-06-15        
###########################################################################################        
options {        
            long_hostnames(off);        
            # doesn't actually help on Solaris, log(3) truncates at 1024 chars        
            log_msg_size(8192);        
            # buffer just a little for performance        
            # sync(1); <- Deprecated - use flush_lines() instead        
            flush_lines(1);        
            # memory is cheap, buffer messages unable to write (like to loghost)        
            log_fifo_size(16384);        
            # Hosts we don't want syslog from    
            #bad_hostname("^(ctld.|cmd|tmd|last)$");    
            # The time to wait before a dead connection is reestablished (seconds)    
            time_reopen(10);    
            #Use DNS so that our good names are used, not hostnames    
            use_dns(yes);    
            dns_cache(yes);    
            #Use the whole DNS name    
            use_fqdn(yes);    
            keep_hostname(yes);    
            chain_hostnames(no);    
            #Read permission for everyone    
            perm(0644);    
            # The default action of syslog-ng 1.6.0 is to log a STATS line    
            # to the file every 10 minutes.    That's pretty ugly after a while.        
            # Change it to every 12 hours so you get a nice daily update of        
            # # how many messages syslog-ng missed (0).        
            # stats(43200);        
};        
    
destination d_logzilla {        
            program("/www/webroot/php-syslog-ng/scripts/db_insert.pl"        
            template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n")        
            template_escape(yes)        
            );        
}; 
# Tell syslog-ng to log to our new destination
log {
source(s_local);
destination(d_logzilla);
destination(d_messages);
};
   

   具体配置文件选项请参考：
http://www.balabit.com/sites/default/files/documents/syslog-ng-v3.0-guide-admin-en.html/chapter_configuration.html 或者

http://www.linuxfly.org/post/171/1/1/

4、安装logzilla
a、安装logzilla所需的web基础环境（本文使用lamp，具体安装略）
b、解压logzilla包，并配置Apache
#mkdir -p /www/webroot/
#cd /www/webroot/
#wget http://php-syslog-ng.googlecode.com/files/logzilla_v2.9.9o.tgz
#tar xzvf logzilla_v2.9.9o.tgz
#mkdir -p /var/log/logzilla

修改Apache配置

<VirtualHost *:80>        
        ServerAdmin [email protected]        
        DocumentRoot /www/webroot/php-syslog-ng/html/        
        ServerName 192.168.1.10    
        ErrorLog logs/error_log        
        CustomLog logs/access_log common        
        # LogZilla        
        Alias /logs "/www/webroot/php-syslog-ng/html/"        
        <Directory "/www/webroot/php-syslog-ng/html/">        
                Options Indexes MultiViews FollowSymLinks        
                AllowOverride All        
                Order allow,deny        
                Allow from all        
</Directory>        
</VirtualHost>

c、web界面安装logzilla

1）浏览http://192.168.1.10/logs进入安装界面：

注：如在改页面出现红色提示，可以调整相应文件和文件夹的权限，以及php的配置。

这样就安装完成了。