一、 关闭防火墙和selinux
setenforce 0
vim /etc/selinux/config
将配置文件中的SELINUX=enforcing 修改为SELINUX=disabled
systemctl stop firewalld
systemctl status firewalld
systemctl disable firewalld
二、安装LAMP
yum install mysql-server mysql-devel httpd php-mysql php php-gd php-xml –y
systemctl start httpd
systemctl enable httpd
systemctl status httpd
三、安装rsyslog等
yum install libcurl-devel net-snmp-devel rsyslog rsyslog-mysql -y
四、安装mysql-server
cd /tmp
wget https://repo.mysql.com//mysql57-community-release-el7-11.noarch.rpm
rpm --import https://repo.mysql.com/RPM-GPG-KEY-mysql-2022
yum localinstall -y mysql57-community-release-el7-11.noarch.rpm
yum repolist enabled | grep "mysql.*-community.*" #正常3个软件
yum install -y mysql-community-server
systemctl start mysqld
systemctl enable mysqld
systemctl status mysqld
五、Mysql操作
grep 'temporary password' '/var/log/mysqld.log' #查mysql默认密码
mysql –p #输入默认密码，进数据库
set password for root@'localhost'=password('Ww,12345678');
exit #退出mysql登录
cd /usr/share/doc/rsyslog-8.24.0/
mysql -uroot -p Ww,12345678 <mysql-createDB.sql #导入数据库Syslog
mysql> show databases; #查询是否有数据库Syslog
grant all on Syslog.* to rsyslog@'localhost' identified by 'P@ssw0rd';
flush privileges; #创建rsyslog用户并授权
六、修改rsyslog配置文件
vim /etc/sysconfig/rsyslog
添加：SYSLOGD_OPTIONS="-c 2 -r -x -m 180" KLOGD_OPTIONS="-x"
七、修改rsyslog.conf配置文件
vi /etc/rsyslog.conf
$ModLoad imudp #去掉前面的
$UDPServerRun 514 #去掉前面的
$ModLoad imtcp #去掉前面的 #
$InputTCPServerRun 514 #去掉前面的
最后面添加2行：
$ModLoad ommysql
*.* :ommysql:127.0.0.1,Syslog,rsyslog,P@ssw0rd
保存:wq
systemctl restart rsyslog
systemctl enable rsyslog
systemctl status rsyslog
八、 loganalyzer的配置
mkdir -p /var/www/html/loganalyzer
mkdir -p /var/log/httpd/loganalyzer
cd /usr/local/src
wget http://download.adiscon.com/loganalyzer/loganalyzer-4.1.6.tar.gz
tar -zxvf loganalyzer-4.1.6.tar.gz
cd loganalyzer-4.1.6
cp -r src/* /var/www/html/loganalyzer
cp -r contrib/* /var/www/html/loganalyzer
cd /var/www/html/loganalyzer
touch config.php
chmod 666 config.php
九、 修改httpd.conf配置文件：找到如下位置，并修改
DocumentRoot
"/var/www/html/loganalyzer"
ErrorLog /var/log/httpd/loganalyzer/error.log
CustomLog /var/log/httpd/loganalyzer/access_log
combined
修改保存后，systemctl restart httpd
十、Web操作
浏览器上输入日志服务器ip
Step 5和step 6都next
十一、修改报错
Vi /var/www/html/loganalyzer/ config.php
修改下面一行的systemevents为SystemEvents
$CFG['Sources']['Source1']['DBTableName'] = 'SystemEvents';
十二、导入中文语言包
下载http://www.90qj.com/content/uploadfile/201811/7d151542678437.zip
解压后，把语言包传到此目录
www/html/loganalyzer/lang
最后效果如下图：
参考文章：
1、https://www.stephenwxf.com/post/106.html
2、https://ithelp.ithome.com.tw/articles/10254668
