Set up Rsyslog log server in CentOS

Set up Rsyslog log server in CentOS
Environment Introduction:

CentOS 6.5X64
Loganalyze-3.6.3
Rsyslog (default)

Logs record the running status of the entire system, including Operation Records, software installation and upgrade, program errors, and other information. They are a system that O & M personnel can't do. Configure a log collection server platform.

1. Install LMAP
For the demonstration, install the SDK directly using yum:

# Yum-y install rsyslog-mysql-server php httpd php-mysql php-gd

2. Import the rsyslog database and configure rsyslog

# Service mysqld start & service httpd start # mysql </usr/share/doc/rsyslog-mysql-5.8.10/createDB. SQL mysql> grant all privileges on Syslog. * to rsyslog @ localhost identified by "123456"; mysql> flush privileges;

# Vi/etc/rsyslog. conf

--------------------------------------

// Add the following content

$ ModLoad ommysql. so

*. *: Ommysql: localhost, Syslog, rsyslog, 123456

// Localhost: mysql address; Syslog: Database Name; rsyslog: connected user, followed by password

--------------------------------------

// Enable the following lines

$ ModLoad immark

$ ModLoad imudp $ UDPServerRun 514

// You know why UDP is used.

--------------------------------------

# Service rsyslog restart

3. Configure Loganalyze

# Wget http://download.adiscon.com/loganalyzer/loganalyzer-3.6.3.tar.gz

# Tar zxvf loganalyzer-3.6.3.tar.gz

# Cp-rf src/var/www/html/

# Cd/var/www/html/

# Mv src log

# Touch config. php & chmod 666 config. php

Open http: // ip/log/install. php in a browser. The page is as follows:

Note that the database name Syslog in Step 7 and the database table SystemEvents (case sensitive) environment are successfully as follows (install in the directory is recommended after installation is complete. the PHP file is deleted. You can see that there is no donation link in the middle of the top. You can modify the configuration file to remove it.

# Vi./include/function_common.php find $ content ['show _ DONATEBUTTON '] = true; change true to flase (73 rows)

4. Add a client Linux:

# Vi/etc/rsyslog. conf added ------------------ $ template logformat, "% TIMESTAMP % <% syslogfacility-text %. % syslogpriority-text %> % HOSTNAME % syslogtag % msg: sp-if-no-1st-sp % msg: drop-last-lf % \ n "*. * @ remote ip: 514; logformat ------------------

Test:

# Sudo logger-p info "Hello, log server, I am your client"

Windows: Because Windows logs are different from Linux logs, you need to use the Evtsys software for conversion. Note that the evtsys_4.4.0_32-bit.zip folder in the system version will be decompressed to the system32 directory, run CMD to back up the syslog service (Registry) and execute

> Evtsys-I-s 10-h rsyslog_IP-p 514

> Net start Evenlog to Syslog

In this case, the system generates an additional system service, for example, the Loganalyze System displays the logs of the client system.