My main blog address is www.cppblog.com/zdhsoft's corresponding centos 6. x!
:Step 1: InstallWget http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.5.4.1/source/syslog-ng_3.5.4.1.tar.gzwget http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.5.4.1/source/eventlog_0.2.12%2B20120504%2B1700.tar.gztar xvf eventlog_0.2.121_201205044251700.tar.gz cd eventlog-0.2.12 + 20120504 + 1700. /configure -- prefix =/usr/local/services/eventlog make install cd ..tar-xvf syslog-ng_3.5.4.1.tar.gz cd syslog-ng-3.5.4.1/export PKG_CONFIG_PATH =/usr/local/services/eventlog/lib/pkgconfig. /configure -- prefix =/usr/local/services/syslog-ng # If no package 'glib-2.0 'found centos # is prompted, use yum install libgnomeui-develmakemake installStep 2: Add a serviceConfigure syslog-ng as the system service, vim/etc/init. d/syslog-ng # Content ################################ ######################################## #########! /Bin/bash # chkconfig:-60 27 # description: syslog-ng SysV script .. /etc/rc. d/init. d/functions syslog_ng =/usr/local/services/syslog-ng/sbin/syslog-ng prog = syslog-ng pidfile =/usr/local/services/syslog-ng/var /syslog-ng.pid lockfile =/usr/local/services/syslog-ng/var/syslog-ng.lock RETVAL = 0 STOP_TIMEOUT = $ {STOP_TIMEOUT-10} start () {echo-n $ "Starting $ prog:" daemon -- pidfile = $ pidfile $ syslog_ng $ Options retval =$? Echo [$ RETVAL = 0] & touch $ {lockfile} return $ RETVAL} stop () {echo-n $ "Stopping $ prog: "killproc-p $ pidfile-d $ STOP_TIMEOUT $ syslog_ng RETVAL =$? Echo [$ RETVAL = 0] & rm-f $ lockfile $ pidfile} case "$1" in start) start; stop) stop; status) status-p $ pidfile $ syslog_ng RETVAL = $?; Restart) stop start; *) echo $ "Usage: $ prog {start | stop | restart | status} "RETVAL = 2 esac exit $ RETVAL ##################### ######################################## ##################### start the chmod a + x/etc/init service. d/syslog-ng killall syslogd chkconfig -- add syslog-ng chkconfig syslog-ng on service syslog-ng startStep 3: actual configurationCommand vi/usr/local/services/syslog-ng/etc/syslog-ng.conf ######################## ######################################## ######################################## ######################################## ################################## Default syslog-ng.conf file which collects all local logs into a # single file called/var/log/messages. # @ version: 3.5 @ include "scl. conf "options {create_dirs (yes); dir_perm (0755); use_dns (no); perm (0644); chain_hostnames (off); stats_freq (30 );}; source s_local {system (); internal () ;}; source s_network {udp (ip ("0.0.0.0") port (514 ));}; destination d_local {file ("/var/log/messages") ;}; log {source (s_local); # uncomment this line to open port 514 to receive messages source (s_network ); destination (d_local) ;}; template t_onlymsgip {template ("$ MSGONLY | $ SOURCEIP \ n") ;}; template t_onlymsg {template ("$ MSGONLY \ n ");}; filter f_cgioss {program ("CGI") and level (crit );}; destination d_cgioss {file ("/usr/local/services/lzlog/cgioss/$ YEAR $ MONTH $ DAY-$ HOUR. oss "template (t_onlymsg) ;}; log {source (s_network); filter (f_cgioss); destination (d_cgioss); flags (final );}; ##### cgi err ##### filter f_cgierr {program ("CGI") and level (err );}; destination d_cgierr {file ("/usr/local/services/lzlog/cgierr/$ YEAR $ MONTH $ DAY-$ HOUR. err "template (t_onlymsgip) ;}; log {source (s_network); filter (f_cgierr); destination (d_cgierr );}; ##### cgi log ##### filter f_cgilog {program ("CGI ");}; destination d_cgilog {file ("/usr/local/services/lzlog/cgilog/$ YEAR $ MONTH $ DAY-$ HOUR. log "template (t_onlymsgip ));}; destination d_minutecgilog {file ("/usr/local/services/lzlog/cgilog/$ YEAR $ MONTH $ DAY-$ HOUR-$ MIN. log "template (t_onlymsgip) ;};# log {source (s_network); filter (f_cgilog); destination (d_minutecgilog) ;}; log {source (s_network ); filter (f_cgilog); destination (d_cgilog); flags (final) ;};#### svr bill ###### the current quantity is small, filter f_svrbill {program ("SVR") and level (info );}; destination d_svrbill {file ("/usr/local/services/lzlog/svrbill/$ YEAR $ MONTH $ DAY-$ HOUR. oss "template (t_onlymsg) ;}; log {source (s_local); filter (f_svrbill); destination (d_svrbill); flags (final );}; filter f_paybill {program ("PAY ");}; destination d_paybill {file ("/usr/local/services/lzlog/paybill/$ YEAR $ MONTH $ DAY-$ HOUR. oss "template (t_onlymsg) ;}; log {source (s_local); filter (f_paybill); destination (d_paybill); flags (final );}; ######################################## ######################################## ###########################