syslog-ng和logzilla实现日志集中管理

原创

junlee 2011-02-18 12:53:31 博主文章分类：企业应用 ©著作权

文章标签 职场休闲 syslog-ng 日志管理 logzilla 文章分类 网络安全

©著作权归作者所有：来自51CTO博客作者junlee的原创作品，请联系作者获取转载授权，否则将追究法律责任

1、安装syslog-ng
#cd /root/pkgs
#wget http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.0.3/setups/rhel-5-i386/syslog-ng-3.0.3-1.rhel5.i386.rpm
#wget http://www.balabit.com/downloads/files/eventlog/0.2/eventlog_0.2.9.tar.gz

#cp eventlog_0.2.9.tar.gz /usr/src/redhat/SOURCES/
#cd /usr/src/redhat/SOURCES/
#tar zxvf eventlog_0.2.9.tar.gz
#cd eventlog-0.2.9/
#rpmbuild --ba eventlog.spec.bb
#cd /usr/src/redhat/RPMS/x86_64
#rpm -Uvh libevtlog*

#cd /root/pkgs/
#rpm -Uvh syslog-ng-3.0.3-1.rhel5.i386.rpm
sysllog-ng软件会安装到/opt/syslog-ng/目录下

2、安装logzilla
#cd /root/pkgs/
#wget http://php-syslog-ng.googlecode.com/files/logzilla_v2.9.9o.tgz
#tar xzvf logzilla_v2.9.9o.tgz
#mkdir -p /var/log/logzilla

3、修改syslog-ng的配置
#cd /opt/syslog-ng/

#vi etc/syslog-ng.conf

@version: 3.0
source s_local {
internal();
unix-stream("/dev/log");
file("/proc/kmsg" program_override("kernel: "));
};
source s_local {
        udp(ip(0.0.0.0) port(514));
};

# destinations
destination d_messages { file("/var/log/syslog-ng/$HOST"); };


###########################################################################################
# Clay's LogZilla config below
###########################################################################################
# Last updated on 2010-06-15
###########################################################################################
options {
            long_hostnames(off);
            # doesn't actually help on Solaris, log(3) truncates at 1024 chars
            log_msg_size(8192);
            # buffer just a little for performance
            # sync(1); <- Deprecated - use flush_lines() instead
            flush_lines(1);
            # memory is cheap, buffer messages unable to write (like to loghost)
            log_fifo_size(16384);
            # Hosts we don't want syslog from
            #bad_hostname("^(ctld.|cmd|tmd|last)$");
            # The time to wait before a dead connection is reestablished (seconds)
            time_reopen(10);
            #Use DNS so that our good names are used, not hostnames
            use_dns(yes);
            dns_cache(yes);
            #Use the whole DNS name
            use_fqdn(yes);
            keep_hostname(yes);
            chain_hostnames(no);
            #Read permission for everyone
            perm(0644);
            # The default action of syslog-ng 1.6.0 is to log a STATS line
            # to the file every 10 minutes.    That's pretty ugly after a while.
            # Change it to every 12 hours so you get a nice daily update of
            # # how many messages syslog-ng missed (0).
            # stats(43200);
};

destination d_logzilla {
            program("/www/webroot/php-syslog-ng/scripts/db_insert.pl"
            template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n")
            template_escape(yes)
            );
};
# Tell syslog-ng to log to our new destination
log {
source(s_local);
destination(d_logzilla);
destination(d_messages);
};

具体配置文件选项请参考：
http://www.balabit.com/sites/default/files/documents/syslog-ng-v3.0-guide-admin-en.html/chapter_configuration.html 或者

http://www.linuxfly.org/post/171/1/1/

4、安装logzilla
a、安装logzilla所需的web基础环境（本文使用lamp，具体安装略）
b、解压logzilla包，并配置Apache
#mkdir -p /www/webroot/
#cd /www/webroot/
#wget http://php-syslog-ng.googlecode.com/files/logzilla_v2.9.9o.tgz
#tar xzvf logzilla_v2.9.9o.tgz
#mkdir -p /var/log/logzilla

修改Apache配置

<VirtualHost *:80>
        ServerAdmin junleeee@163.com
        DocumentRoot /www/webroot/php-syslog-ng/html/
ServerName 192.168.1.10
        ErrorLog logs/error_log
        CustomLog logs/access_log common
        # LogZilla
        Alias /logs "/www/webroot/php-syslog-ng/html/"
        <Directory "/www/webroot/php-syslog-ng/html/">
                Options Indexes MultiViews FollowSymLinks
                AllowOverride All
                Order allow,deny
                Allow from all
</Directory>
</VirtualHost>

c、web界面安装logzilla

1）浏览http://192.168.1.10/logs进入安装界面：