安裝syslog-ng管理日誌

標籤：需愛交流解決的文檔

安裝了syslog-ng統一管理伺服器日誌，安裝方法是網上找的，現在有些問題需要解決；

1.Log Service器可以同步日子，但是由於要自訂管理想要的記錄檔，一直不能同步到伺服器，現在貼出配置文檔，希望可以交流學習。

安裝syslog-ng

service 端安裝：

yum install gcc*  

cd /usr/src 

wget http://www.balabit.com/downloads/files/syslog-ng/sources/3.2.4/source/eventlog_0.2.12.tar.gz 

wget http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.3.5/source/syslog-ng_3.3.5.tar.gz 

tar xvf eventlog_0.2.12.tar.gz 

cd eventlog-0.2.12 

./configure --prefix=/usr/local/eventlog 

make 

make install 

 

cd /usr/src 

tar xvf syslog-ng_3.3.5.tar.gz 

cd syslog-ng-3.3.5 

export PKG_CONFIG_PATH=/usr/local/eventlog/lib/pkgconfig 

./configure --prefix=/usr/local/syslog-ng 

make 

make install 

 

 

將syslog-ng添加為系統服務, 

vim /etc/init.d/syslog-ng  #內容如下 

#!/bin/bash 

#  

# chkconfig: -  60 27 

# description: syslog-ng SysV script.  

. /etc/rc.d/init.d/functions 

 

syslog_ng=/usr/local/syslog-ng/sbin/syslog-ng 

prog=syslog-ng 

pidfile=/usr/local/syslog-ng/var/syslog-ng.pid 

lockfile=/usr/local/syslog-ng/var/syslog-ng.lock 

RETVAL=0 

STOP_TIMEOUT=${STOP_TIMEOUT-10} 

 

start() { 

        echo -n $"Starting $prog: " 

        daemon --pidfile=$pidfile $syslog_ng $OPTIONS 

        RETVAL=$? 

        echo 

        [ $RETVAL = 0 ] && touch ${lockfile} 

        return $RETVAL 

} 

 

stop() { 

    echo -n $"Stopping $prog: " 

    killproc -p $pidfile -d $STOP_TIMEOUT $syslog_ng 

    RETVAL=$? 

    echo 

    [ $RETVAL = 0 ] && rm -f $lockfile $pidfile 

} 

 

case "$1" in 

  start) 

    start 

    ;; 

  stop) 

    stop 

    ;; 

  status) 

        status -p $pidfile $syslog_ng 

    RETVAL=$? 

    ;; 

  restart) 

    stop 

    start 

    ;; 

  *) 

    echo $"Usage: $prog {start|stop|restart|status}" 

    RETVAL=2 

esac 

exit $RETVAL 

------------------------------------------------------------ 

chmod a+x /etc/init.d/syslog-ng 

killall syslogd 

chkconfig --add syslog-ng 

chkconfig syslog-ng on 

service syslog-ng start 

 設定檔/usr/local/syslog-ng/etc/syslog-ng.conf

#下文為完整設定檔，注意：

@version:3.3.5

@include "scl.conf"

options {

#long_hostnames(off);

log_msg_size(8192);

flush_lines(1);

log_fifo_size(20480);

time_reopen(10);

use_dns(yes);

dns_cache(yes);

use_fqdn(yes);

keep_hostname(yes);

chain_hostnames(no);

#chain_hostnames(off);

perm(0644);

stats_freq(43200);

};

source s_internal { internal(); };

destination d_syslognglog { file("/var/log/syslog-ng.log"); };

log { source(s_internal); destination(d_syslognglog); };

source s_local {

        unix-dgram("/dev/log");

         file("/proc/kmsg"program_override("kernel:"));

};

#定義7種日誌類型

filter f_messages { level(info..emerg); };

filter f_secure { facility(authpriv); };

filter f_mail { facility(mail); };

filter f_cron { facility(cron); };

filter f_emerg { level(emerg); };

filter f_spooler { level(crit..emerg) and facility(uucp, news); };

filter f_local7 { facility(local7); };

filter f_local4 { facility(local4); };

#定義7種類型日誌在用戶端的位置

destination d_messages { file("/var/log/messages"); };

destination d_secure { file("/var/log/secure"); };

destination d_maillog { file("/var/log/maillog"); };

destination d_cron { file("/var/log/cron"); };

destination d_console { usertty("root"); };

destination d_spooler { file("/var/log/spooler"); };

destination d_bootlog { file("/var/log/dmesg"); };

destination d_usercmd { file("/var/log/usercmd.log"); };

log { source(s_local); filter(f_emerg); destination(d_console); };

log { source(s_local); filter(f_secure); destination(d_secure); flags(final);};

log { source(s_local); filter(f_mail); destination(d_maillog); flags(final); };

log { source(s_local); filter(f_cron); destination(d_cron); flags(final); };

log { source(s_local); filter(f_spooler); destination(d_spooler); };

log { source(s_local); filter(f_local7); destination(d_bootlog); };

log { source(s_local); filter(f_messages); destination(d_messages); };

log { source(s_local); filter(f_local4); destination(d_usercmd); };

#定義監聽的連接埠

# Remote logging

source s_remote {

         tcp(ip(0.0.0.0)port(514));

         udp(ip(0.0.0.0) port(514));

};

#定義用戶端日誌在伺服器上儲存的格式，位置和許可權等

destination r_console{file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/console"owner("root") group("root") perm(0640) dir_perm(0750)create_dirs(yes));};

destination r_secure{file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/secure" owner("root")group("root") perm(0640) dir_perm(0750) create_dirs(yes));};

destination r_cron{file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/cron"owner("root") group("root") perm(0640) dir_perm(0750)create_dirs(yes));};

destination r_spooler {file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/spooler"owner("root") group("root") perm(0640) dir_perm(0750)create_dirs(yes));};

destination r_bootlog{file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/bootlog"owner("root") group("root") perm(0640) dir_perm(0750)create_dirs(yes));};

destination r_messages{file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/messages"owner("root") group("root") perm(0640) dir_perm(0750)create_dirs(yes));};

destination r_usercmd{file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/usercmd"owner("root") group("root") perm(0640) dir_perm(0750)create_dirs(yes));};

destination r_maillog{file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/maillog"owner("root") group("root") perm(0640) dir_perm(0750)create_dirs(yes));};

log { source(s_remote); filter(f_emerg); destination(r_console); };

log { source(s_remote); filter(f_secure); destination(r_secure); flags(final);};

log { source(s_remote); filter(f_cron); destination(r_cron); flags(final); };

log { source(s_remote); filter(f_spooler); destination(r_spooler); };

log { source(s_remote); filter(f_local7); destination(r_bootlog); };

log { source(s_remote); filter(f_messages); destination(r_messages); };

log { source(s_remote); filter(f_local4); destination(r_usercmd); };

log { source(s_remote); filter(f_mail); destination(r_usercmd); };

#############################################3

註：如果要新加監控的服務log，需要添加幾個地方：標紅的設定檔

在client 端加入

local4.* /var/log/usercmd.log

#  /usr/local/syslog-ng/sbin/syslog-ng -e -F -d -v

測試syslog-ng設定檔是否正確

Client 端 我們使用rsyslog系統內建收集log服務

vi /etc/rsyslog.conf

最下邊加入一行

*.info                   @10.0.11.53

  vi /etc/syslog.conf

   添加如下：

   *.info;mail.none;news.none;authpriv.none;cron.none @service ip

安裝syslog-ng管理日誌