日志主机安装指南
 
一.希望达到的目的
       1.服务器日志集中存放到MySQL数据库中;
       2.每天发送一封E-MAIL, 报告异常日志条目;
       3.实时报告异常系统事件;
       4WEB界面查询日志;
二.日志主机安装和配置
各个软件的功能及交互图
 
 
1.安装syslog-ng:
   [url]http://www.balabit.com/downloads/syslog-ng[/url]下载 eventlog, libol, syslog-ng tarball.
   安装eventlog:   # ./configure  --prefix=/usr/local/eventlog && make && make install
   安装 libol:      # ./configure –prefix=/usr/local/libol &&make && make install
   安装 syslog-ng:  # export PKG_CONFIG_PATH=/usr/local/eventlog/pkgconfig/
                           # ./configure –prefix=/usr/local/syslog-ng --with-libol=/usr/local/libol
                           # make && make install
   配置 syslog-ng:  # vi /usr/local/syslog-ng/etc/syslog-ng/syslog-ng.conf
        options {
            keep_hostname(yes);
            long_hostnames(off);
            sync(1);
            log_fifo_size(1024);
    create_dirs(yes);  # if a dir does not exist create it
            owner(root);       # owner of created files
            group(root);       # group of created files
            perm(0600);        # permissions of created files
            dir_perm(0700);    # permissions of created dirs
};
    source s_all {
            udp();                    # remote logs
                                      # arriving at 514/udp
            unix-stream("/dev/log");  # local system logs
            file("/proc/kmsg");       # local kernel logs
            internal();               # internal syslog-ng logs
            };
    destination single-file {
             file("/var/log/syslog-ng/all-messages");
            };
    log {
            source(s_all);
            destination(single-file);
            };
   启动 syslog-ng:  # /etc/init.d/syslog stop
                    # /usr/local/syslog-ng/sbin/syslog-ng
   验证:ps ef|grep syslog-ng
         查看文件:/var/log/syslog-ng/all-messages
2. 安装MySQL到 /usr/local/mysql 下,以存放日志。
3. 安装 SQLSyslogd, 以便将日志写入 MySQL 数据库中:
   安装:# ln s /usr/local/mysql/lib/mysql /usr/local/lib/mysql
         # ln s /usr/local/mysql/include/mysql \
              /usr/local/include/lib
         # make && cp sqlsyslogd /usr/local/sbin/
         # cat /usr/local/lib/mysql >> /etc/ld.so.conf && ldconfig
   验证 sqlsyslogd 能正常运行:# sqlsyslogd
        如果正常,你可以看到 sqlsyslogd 的帮助信息。
   修改 sqlsyslogd.sql 文件: # vi sqlsyslogd.sql
        create database sqlsyslogd;
        use sqlsyslogd;
        create table logs (
            Id int(10) NOT NULL auto_increment,
            Timestamp varchar(16),
            Host varchar(50),
            Prog varchar(50),
            Mesg text,
            PRIMARY KEY (id)
        );
        use mysql;
        create user sqlsyslogd@localhost identified by foo;
        grant all on sqlsyslogd.* to sqlsyslogd;
        flush privileges;
        # sql u root p < sqlsyslogd.sql
        # vi /usr/local/etc/sqlsyslogd.conf
          foo
   修改 syslog-ng.conf 文件,添加下面几行:
      destination mysql {
            program(/usr/local/sbin/sqlsyslogd u sqlsyslogd \
                      t logs sqlsyslogd p);
            };
      log {
            source(all);
            destination(mysql);
            };
   重启 syslog-ng: # pkill SIGHUP syslog-ng
   验证:现在你应该可以通过 MySQL 客户端软件查看日志了。
4.安装 logcheck 和 newlogcheck:
   [url]http://www.campin.net/download/[/url] 下载 newlogcheck.tgz
   安装:# mkdir p /usr/local/logcheck/bin \
           /usr/local/logcheck/etc/ /usr/local/logcheck/tmp
         # cd logcheck-<version>
           修改 Makefile 文件,将其中 /usr/local
           为 /usr/local/logcheck
          # make linux
          # cd newlogcheck-<version> && \
            cp *\.* /usr/local/logcheck/etc/
    配置:根据logcheck各个文件的位置修改 /usr/local/logcheck/etc/
          目录下的 newlogcheck.sh sort_logs.pl
          # mkdir /usr/local/logcheck/tmp/host
    测试:# /usr/local/logcheck/etc/newlogcheck.sh
     如果安装正常,你应该收到一封e-mail, 现在你可以安装一个
     crontab 来自动化logcheck日志
     检查: # crontab e
                
                10 2 * * * /usr/local/logcheck/etc/newlogcheck.sh
5.安装 swatch:
   按顺序安装下面的perl 模块:Carp-Clan, Bit-Vector, Date-Calc,
   Time-HiRes, File-Tail,TimeDate, swatch(使用3.0.8版本,
   不要用3.0.12)
   配置 swatch: #vi /etc/swatch.conf
    watchfor /Failed password/
        mail address=root, subject=warning: Failed password
        throttle 01:00
    watchfor /Invalid user/
        mail address=root, subject=warning: Invalid user
        throttle 01:00
    watchfor /authentication failure/
        mail address=root, subject=warning: authentication failure
        throttle 01:00
    watchfor /iptables:/
        mail address=root, subject=warning: iptables operation
        throttle 01:00
    watchfor /Duplicate address/
        mail address=root, subject=warning: Duplicate address
        throttle 01:00
    watchfor /file system full/
        mail address=root, subject=warning: file system full
        throttle 01:00
    watchfor /(panic|halt)/
        mail address=root, subject=warning: panic or halt happened
        throttle 01:00
    watchfor /Media Error/
        mail address=root, subject=warning: disk error happened
        throttle 01:00
    ……
   运行swatch: # /usr/bin/swatch --config-file=/etc/swatch.conf \
                   --tail-file=/var/log/syslog-ng/all-messages &
   验证:ps ef|grep swatch | grep v grep
         如果正常,你应该看到2个进程:
         root  ......   /usr/bin/perl /usr/bin/swatch \
                  --config-file=/etc/swatch.conf \
                  --tail-file=/var/log/syslog-ng/all-messages
         root  ......   /usr/bin/perl
                 /root/.swatch_script.17374 ß 你看到的将是其他数字
6.安装 splunk:
   [url]http://www.splunk.com[/url] 下载 splunk tarball
   解压 splunk tarball 并将其移动到 /usr/local/splunk
   修改 /usr/local/splunk/bin/setSplunkEvn  
   和 /usr/local/splunk/etc/init.d/redhat/splunk,将
   其中的 $SPLUNK_HOME 设置为 /usr/local/splunk, 将  
   /usr/local/splunk/etc/init.d/redhat/splunk 拷贝到
   /etc/init.d/目录下,
   # chmod 700 /etc/init.d/splunk && chkconfig splunk on
   启动splunk: /etc/init.d/splunk start
   现在你可以通过 WEB 浏览器访问 splunk 了:[url]http://localhost:8000/[/url]
 
   配置:
       
现在你可以搜索日志了.
7.配置启动:vi /etc/rc.local
/usr/local/syslog-ng/sbin/syslog-ng
/usr/bin/swatch config-file=/etc/swatch.conf \
   tail-file=/var/syslog-ng/all-messages &
 
三.日志客户机配置
这里所说的日志客户机指需要把自己的日志传送给日志主机的服务器。
我们在日志客户机上的配置很简单,只需要两步:
1. 在 /etc/syslog.conf 文件添加一项,使日志客户机把自己的严重程度在.info以上的日志也发送给日志主机:
# cat /etc/syslog.conf
...
*.info                               @log_host
2. 在 /etc/hosts 文件里面添加一项,使日志客户机能解析上面的 log_host:
# cat /etc/hosts
...
x.x.x.x                              log_host
 
总结,配置一个日志主机,需要花费较大的功夫。但是,一旦你配置好了,它给你带来的益处也很大,比如,你能够随时查阅很久以前的日志,你能及时知道某台服务器的硬盘有问题了,如果有******了你的服务器,不管他如何销毁自己的踪迹,你都能够他在***过程中留下的痕迹,等等等等。所以,花大力气建立这样一个日志主机还是明智的。