Linuxsyslog系統(tǒng)日志管理
Linux syslog 系統(tǒng)日志管理
創(chuàng)新互聯(lián)建站專(zhuān)注為客戶提供全方位的互聯(lián)網(wǎng)綜合服務(wù)，包含不限于做網(wǎng)站、網(wǎng)站建設(shè)、項(xiàng)城網(wǎng)絡(luò)推廣、重慶小程序開(kāi)發(fā)公司、項(xiàng)城網(wǎng)絡(luò)營(yíng)銷(xiāo)、項(xiàng)城企業(yè)策劃、項(xiàng)城品牌公關(guān)、搜索引擎seo、人物專(zhuān)訪、企業(yè)宣傳片、企業(yè)代運(yùn)營(yíng)等，從售前售中售后，我們都將竭誠(chéng)為您服務(wù)，您的肯定，是我們最大的嘉獎(jiǎng)；創(chuàng)新互聯(lián)建站為所有大學(xué)生創(chuàng)業(yè)者提供項(xiàng)城建站搭建服務(wù)，24小時(shí)服務(wù)熱線：13518219792，官方網(wǎng)址：m.kartarina.com
===============================================================================
rsyslog記錄日志于MySQL：
操作如下：
實(shí)驗(yàn)環(huán)境：CentOS 7 操作系統(tǒng)
前提：
準(zhǔn)備好msql server或mariadb server（一定要編輯配置文件/etc/my.cnf,添加跳過(guò)反向解析等）并啟動(dòng)服務(wù)；
實(shí)驗(yàn)步驟：
1.安裝rsyslog連接至mysql server的驅(qū)動(dòng)模塊；
# yum install rsyslog-mysql
2.在mysql server準(zhǔn)備rsyslog專(zhuān)用的用戶賬號(hào)；
[root@centos7 ~]# mysql -p Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 3 Server version: 5.5.44-MariaDB MariaDB Server Copyright (c) 2000, 2015, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. # 授權(quán)數(shù)據(jù)庫(kù)Syslog的所有表允許rsyslog用戶在本地主機(jī)訪問(wèn)，訪問(wèn)密碼為134296 MariaDB [(none)]> GRANT ALL ON Syslog.* TO 'rsyslog'@'127.0.0.1' IDENTIFIED BY '134296'; Query OK, 0 rows affected (0.00 sec) # 為了安全不被反解，再授權(quán)一個(gè)使用local的本地主機(jī) MariaDB [(none)]> GRANT ALL ON Syslog.* TO 'rsyslog'@'local' IDENTIFIED BY '134296'; Query OK, 0 rows affected, 1 warning (0.00 sec) MariaDB [(none)]> FLUSH PRIVILEGES； Query OK, 0 rows affected (0.01 sec) MariaDB [(none)]> use mysql; MariaDB [mysql]> SELECT user,host,password FROM user; +------------+-----------+-------------------------------------------+ | user | host | password | +------------+-----------+-------------------------------------------+ | root | localhost | *41EE0F8759D5340036B009143E1727DB5787A448 | | root | centos7 | *41EE0F8759D5340036B009143E1727DB5787A448 | | root | 127.0.0.1 | *41EE0F8759D5340036B009143E1727DB5787A448 | | root | ::1 | *41EE0F8759D5340036B009143E1727DB5787A448 | | ultraxuser | 127.0.0.1 | *41EE0F8759D5340036B009143E1727DB5787A448 | | ultraxuser | localhost | *41EE0F8759D5340036B009143E1727DB5787A448 | | rsyslog | 127.0.0.1 | *41EE0F8759D5340036B009143E1727DB5787A448 | # 授權(quán)的用戶 | rsyslog | local | *41EE0F8759D5340036B009143E1727DB5787A448 | +------------+-----------+-------------------------------------------+ 8 rows in set (0.00 sec) MariaDB [mysql]> \q Bye
3.生成所需要的數(shù)據(jù)庫(kù)和表；
前面已經(jīng)安裝了rsyslog連接至mysql server的驅(qū)動(dòng)模塊rsyslog-mysql，查看其配置文件如下：
[root@centos7 ~]# rpm -ql rsyslog-mysql /usr/lib64/rsyslog/ommysql.so /usr/share/doc/rsyslog-7.4.7/mysql-createDB.sql # 是生成數(shù)據(jù)庫(kù)和表的一個(gè)腳本文件 [root@centos7 ~]# cat /usr/share/doc/rsyslog-7.4.7/mysql-createDB.sql CREATE DATABASE Syslog; USE Syslog; CREATE TABLE SystemEvents ( ID int unsigned not null auto_increment primary key, CustomerID bigint, ReceivedAt datetime NULL, DeviceReportedTime datetime NULL, Facility smallint NULL, Priority smallint NULL, FromHost varchar(60) NULL, Message text, NTSeverity int NULL, Importance int NULL, EventSource varchar(60), EventUser varchar(60) NULL, EventCategory int NULL, EventID int NULL, EventBinaryData text NULL, MaxAvailable int NULL, CurrUsage int NULL, MinUsage int NULL, MaxUsage int NULL, InfoUnitID int NULL , SysLogTag varchar(60), EventLogType varchar(60), GenericFileName VarChar(60), SystemID int NULL ); CREATE TABLE SystemEventsProperties ( ID int unsigned not null auto_increment primary key, SystemEventID int NULL , ParamName varchar(255) NULL , ParamValue text NULL );
直接把腳本導(dǎo)入數(shù)據(jù)庫(kù)中
[root@centos7 ~]# mysql -ursyslog -h227.0.0.1 -p134296 < /usr/share/doc/rsyslog-7.4.7/mysql-createDB.sql # 登錄數(shù)據(jù)庫(kù)查看如下： [root@centos7 ~]# mysql -ursyslog -h227.0.0.1 -p134296 Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 7 Server version: 5.5.44-MariaDB MariaDB Server Copyright (c) 2000, 2015, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> show databases; +--------------------+ | Database | +--------------------+ | information_schema | | Syslog | | test | +--------------------+ 3 rows in set (0.00 sec) MariaDB [(none)]> use Syslog; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Database changed MariaDB [Syslog]> show tables; +------------------------+ | Tables_in_Syslog | +------------------------+ | SystemEvents | | SystemEventsProperties | +------------------------+ 2 rows in set (0.00 sec) MariaDB [Syslog]> desc SystemEvents; +--------------------+------------------+------+-----+---------+----------------+ | Field | Type | Null | Key | Default | Extra | +--------------------+------------------+------+-----+---------+----------------+ | ID | int(10) unsigned | NO | PRI | NULL | auto_increment | | CustomerID | bigint(20) | YES | | NULL | | | ReceivedAt | datetime | YES | | NULL | | | DeviceReportedTime | datetime | YES | | NULL | | | Facility | smallint(6) | YES | | NULL | | | Priority | smallint(6) | YES | | NULL | | | FromHost | varchar(60) | YES | | NULL | | | Message | text | YES | | NULL | | | NTSeverity | int(11) | YES | | NULL | | | Importance | int(11) | YES | | NULL | | | EventSource | varchar(60) | YES | | NULL | | | EventUser | varchar(60) | YES | | NULL | | | EventCategory | int(11) | YES | | NULL | | | EventID | int(11) | YES | | NULL | | | EventBinaryData | text | YES | | NULL | | | MaxAvailable | int(11) | YES | | NULL | | | CurrUsage | int(11) | YES | | NULL | | | MinUsage | int(11) | YES | | NULL | | | MaxUsage | int(11) | YES | | NULL | | | InfoUnitID | int(11) | YES | | NULL | | | SysLogTag | varchar(60) | YES | | NULL | | | EventLogType | varchar(60) | YES | | NULL | | | GenericFileName | varchar(60) | YES | | NULL | | | SystemID | int(11) | YES | | NULL | | +--------------------+------------------+------+-----+---------+----------------+ 24 rows in set (0.01 sec) MariaDB [Syslog]> Ctrl-C -- exit! Aborted
4.配置rsyslog使用ommysql模塊
[root@centos7 ~]# vim /etc/rsyslog.conf #### MODULES #### ...... $ModLoad ommysql
5.配置RULES，將所期望的日志信息記錄于mysql中；
facility.priority :ommysql:DBHOST,DB,DBUSER,DBUSERPASS
6.重啟rsyslog服務(wù)；登錄數(shù)據(jù)庫(kù)查看如下
# systemctl start rsyslog # 重啟服務(wù) [root@centos7 ~]# mysql -ursyslog -h227.0.0.1 -p134296 Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 9 Server version: 5.5.44-MariaDB MariaDB Server Copyright (c) 2000, 2015, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> use Syslog; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Database changed MariaDB [Syslog]> select * from SystemEvents\G； *************************** 11. row *************************** ID: 11 CustomerID: NULL ReceivedAt: 2016-10-20 16:00:01 DeviceReportedTime: 2016-10-20 16:00:01 Facility: 9 Priority: 6 FromHost: centos7 Message: (root) CMD (/usr/lib64/sa/sa1 1 1) NTSeverity: NULL Importance: NULL EventSource: NULL EventUser: NULL EventCategory: NULL EventID: NULL EventBinaryData: NULL MaxAvailable: NULL CurrUsage: NULL MinUsage: NULL MaxUsage: NULL InfoUnitID: 1 SysLogTag: CROND[3521]: EventLogType: NULL GenericFileName: NULL SystemID: NULL 11 rows in set (0.00 sec)
7.loganalyzer圖形化工具
WebGUI, 運(yùn)行amp環(huán)境中；
1）獲取loganalyzer-3.6.5.tar.gz
lftp 10.1.0.1:/pub/Sources/sources/loganalyzer> ls -rwxr--r-- 1 500 500 1046600 Aug 24 2013 loganalyzer-3.6.4.tar.gz -rwxr--r-- 1 500 500 1046957 Aug 19 2014 loganalyzer-3.6.5.tar.gz lftp 10.1.0.1:/pub/Sources/sources/loganalyzer> mget loganalyzer-3.6.5.tar.gz 1046957 bytes transferred lftp 10.1.0.1:/pub/Sources/sources/loganalyzer> bye [root@centos7 ~]# ls anaconda-ks.cfg bin Templates Desktop Documents loganalyzer-3.6.5.tar.gz Pictures Videos Downloads Music Public [root@centos7 ~]# tar xf loganalyzer-3.6.5.tar.gz # 解壓縮 [root@centos7 ~]# cd loganalyzer-3.6.5/ [root@centos7 loganalyzer-3.6.5]# admin bbs drupal-7.28 lastlog.txt messages.txt phpinfo.php phpMyAdmin-4.0.5-all-languages php-mysql.php pma src text.html # 只復(fù)制src目錄到/var/www/html/中，并命名為loganalyzer-3.6.5 [root@centos7 loganalyzer-3.6.5]# cp -a src/ /var/www/html/loganalyzer-3.6.5 [root@centos7 loganalyzer-3.6.5]# cd /var/www/html/ [root@centos7 html]# ln -sv loganalyzer-3.6.5/ log # 創(chuàng)建軟鏈接 ‘log’ -> ‘loganalyzer-3.6.5/’ [root@centos7 html]# ll total 432 drwxr-xr-x 2 root root 38 Oct 14 12:51 admin drwxr-xr-x 12 root root 4096 Jun 9 2015 bbs drwxr-xr-x 9 6226 6226 4096 May 8 2014 drupal-7.28 -rw-r--r-- 1 root root 585460 Oct 10 22:08 lastlog.txt lrwxrwxrwx 1 root root 18 Oct 20 16:27 log -> loganalyzer-3.6.5/ # 鏈接文件 drwxrwxr-x 14 root root 4096 Oct 9 2013 loganalyzer-3.6.5 -rw-r--r-- 1 root root 329712 Oct 11 09:19 messages.txt -rw-r--r-- 1 root root 25 Oct 11 22:03 phpinfo.php drwxr-xr-x 9 root root 4096 Oct 13 11:05 phpMyAdmin-4.0.5-all-languages -rw-r--r-- 1 root root 125 Oct 12 22:27 php-mysql.php lrwxrwxrwx 1 root root 31 Oct 13 10:54 pma -> phpMyAdmin-4.0.5-all-languages/ -rw-r--r-- 1 root root 139 Oct 8 17:00 text.html # 到原來(lái)的目錄中找到contrib目錄，這里面有兩個(gè)腳本，可以幫助我們配置源碼。 [root@centos7 loganalyzer-3.6.5]# ls contrib/ configure.sh secure.sh [root@centos7 loganalyzer-3.6.5]# cp contrib/* /var/www/html/log/ # 復(fù)制過(guò)去 [root@centos7 log]# cat configure.sh # 從安裝步驟中得知要先執(zhí)行此腳本 #!/bin/sh touch config.php chmod 666 config.php [root@centos7 log]# cat secure.sh #!/bin/sh chmod 644 config.php # 安裝完成之后執(zhí)行此腳本 [root@centos7 log]# touch config.php # 因?yàn)樘?jiǎn)單所以，自己手動(dòng)修改即可 [root@centos7 log]# chmod 666 config.php
2）準(zhǔn)備amp環(huán)境，這里以httpd+php為模塊的方式
3）安裝配置如下圖
注意：這里localhost應(yīng)該改為127.0.0.1 編輯配置文件config.php即可
安裝php-gd可以顯示柱狀圖
步驟總結(jié)如下：
網(wǎng)站名稱(chēng)：Linuxsyslog系統(tǒng)日志管理
網(wǎng)頁(yè)鏈接：http://m.kartarina.com/article30/jedcpo.html
成都網(wǎng)站建設(shè)公司_創(chuàng)新互聯(lián)，為您提供靜態(tài)網(wǎng)站、品牌網(wǎng)站設(shè)計(jì)、網(wǎng)站制作、電子商務(wù)、域名注冊(cè)、ChatGPT
聲明：本網(wǎng)站發(fā)布的內(nèi)容（圖片、視頻和文字）以用戶投稿、用戶轉(zhuǎn)載內(nèi)容為主，如果涉及侵權(quán)請(qǐng)盡快告知，我們將會(huì)在第一時(shí)間刪除。文章觀點(diǎn)不代表本網(wǎng)站立場(chǎng)，如需處理請(qǐng)聯(lián)系客服。電話：028-86922220；郵箱：631063699@qq.com。內(nèi)容未經(jīng)允許不得轉(zhuǎn)載，或轉(zhuǎn)載時(shí)需注明來(lái)源： 創(chuàng)新互聯(lián)
- 企業(yè)建站前必須了解的網(wǎng)站建設(shè)基礎(chǔ)知識(shí) 2016-12-01
- 企業(yè)建站前的市場(chǎng)分析 2022-05-04
- 到底企業(yè)建站采用動(dòng)態(tài)網(wǎng)頁(yè)好還是靜態(tài)網(wǎng)頁(yè)好 2021-11-07
- 企業(yè)建站從哪些方面來(lái)改善體驗(yàn) 2023-02-24
- 企業(yè)建站怎樣選擇自己的域名 2021-12-23
- 企業(yè)建站：低價(jià)背后的真相 2016-09-27
- 手機(jī)網(wǎng)站成為企業(yè)建站標(biāo)配 2016-11-10
- 企業(yè)建站的重要性及作用 2022-09-23
- 企業(yè)建站如何選擇建站系統(tǒng) 2017-12-13
- 企業(yè)建站 怎樣選個(gè)好的網(wǎng)站供應(yīng)商 2015-09-05
- 網(wǎng)站建設(shè)公司今天來(lái)跟您講述企業(yè)建站前的幾個(gè)需要注意的事 2022-01-30
- 渭城區(qū)找網(wǎng)站建設(shè)企業(yè)建站工作流程有什么 2016-11-16