rsync日志记录什么 rsyslog日志存放路径

转载

mob64ca14017c37 2024-08-12 15:07:24

文章标签 rsync日志记录什么 php 数据库运维 mysql 文章分类 运维

[root@server vusers_home]# rpm -ql rsyslog|more       ###.so结尾为模块，模块有分im为输入模块，om 为输出模块
/etc/logrotate.d/syslog
/etc/pki/rsyslog
/etc/rc.d/init.d/rsyslog
/etc/rsyslog.conf
/etc/rsyslog.d
/etc/sysconfig/rsyslog
/lib64/rsyslog
/lib64/rsyslog/imfile.so
/lib64/rsyslog/imklog.so
/lib64/rsyslog/immark.so
/lib64/rsyslog/impstats.so
/lib64/rsyslog/imptcp.so
/lib64/rsyslog/imtcp.so
/lib64/rsyslog/imudp.so
/lib64/rsyslog/imuxsock.so
/lib64/rsyslog/lmnet.so
/lib64/rsyslog/lmnetstrms.so
/lib64/rsyslog/lmnsd_ptcp.so
/lib64/rsyslog/lmregexp.so
/lib64/rsyslog/lmstrmsrv.so
/lib64/rsyslog/lmtcpclt.so
/lib64/rsyslog/lmtcpsrv.so
/lib64/rsyslog/lmzlibw.so
/lib64/rsyslog/ommail.so
/lib64/rsyslog/omprog.so
/lib64/rsyslog/omruleset.so
/lib64/rsyslog/omtesting.so
/lib64/rsyslog/omuxsock.so
/lib64/rsyslog/pmlastmsg.so
/sbin/rsyslogd......

主程序：rsyslogd
配置文件：/etc/rsyslog.conf
服务脚本：/etc/rc.d/init.d/rsyslog
/var/log/dmesg #是用来记录系统启动日志的

rsyslog.conf(配置文件)
 RULES:
 facility.priority target
 日志收集方：
 facility：设施，从功能或程序上对日志进行分类；
 auth, authpriv, cron, daemon, kern, lpr, mail, mark, news, security, user, uucp, local0-local7, syslog
 priority
 debug, info, notice, warn(warning), err(error), crit(critical), alert, emerg(panic)
 示例：
 *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access.
 authpriv.* 　　　　　　　　　　　　　　　　 /var/log/secure # Log all the mail messages in one place.
 mail.*　　　　　　　　　　　　　　　　　　 -/var/log/maillog # Log cron stuff
 cron.*                                                   /var/log/cron # Everybody gets emergency messages
 *.emerg　　　　　　　　　　　　　　　　　 * # Save news errors of level crit and higher in a special file.
 uucp,news.crit /var/log/spooler # Save boot messages also to boot.log
 local7.* 　　　　　　　　　　　　　　 /var/log/boot.log 指定级别：
 *: 所有级别
 none: 没有级别
 priority: 此级别及更高级别的日志信息
 =priority：此级别 target: 
 文件路径：记录于指定的日志文件中，通常应该在/var/log目录下；文件路径前的“-”表示异步写入；
 用户：将日志通知给指定用户
 *: 所有用户
 日志服务器：@host
 host: 必须要监听在tcp或udp协议514端口上提供服务；
 管道： |COMMAND

测试实例：

ssh 服务单独记录一个日志文件：

[root@server vusers_home]# vim /etc/ssh/sshd_config 
# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#SyslogFacility AUTHPRIV
SyslogFacility local2            #将原有的换成local2[root@server vusers_home]# service sshd reload
Reloading sshd: [ OK ]
[root@server vusers_home]# vim /etc/rsyslog.conf # Save boot messages also to boot.log
local7.*                                                 /var/log/boot.log
local2.*   　　　　　　　　　　　　　　　　 /var/log/sshd.log[root@server vusers_home]# service rsyslog restart 
Shutting down system logger: [ OK ]
Starting system logger: [ OK ]在另外一个端口重新登录并查看日志：
[root@server vusers_home]# cat /var/log/sshd.log 
May 18 16:04:50 server sshd[5290]: reverse mapping checking getaddrinfo for bogon [192.168.244.2] failed - POSSIBLE BREAK-IN ATTEMPT!
May 18 16:04:50 server sshd[5290]: Accepted password for root from 192.168.244.2 port 62797 ssh2
[root@server vusers_home]# cat /var/log/sshd.log 
May 18 16:04:50 server sshd[5290]: reverse mapping checking getaddrinfo for bogon [192.168.244.2] failed - POSSIBLE BREAK-IN ATTEMPT!
May 18 16:04:50 server sshd[5290]: Accepted password for root from 192.168.244.2 port 62797 ssh2

文件记录的日志的格式：
事件产生的日期时间主机进程(pid)：事件内容

例：

May 18 16:02:27 server sshd[5239]: Server listening on :: port 22.
May 18 16:03:46 server kernel: Kernel logging (proc) stopped.
 有些日志记录二进制格式：/var/log/wtmp，/var/log/btmp
 /var/log/wtmp: 当前系统上成功登录的日志；
 last例子：
[root@server ~]# last
root pts/1 192.168.244.2 Thu May 18 16:04 still logged in 
root pts/1 192.168.244.2 Thu May 18 16:04 - 16:04 (00:00) 
root pts/0 192.168.244.2 Thu May 18 10:40 - 16:37 (05:56) 
root pts/0 192.168.244.2 Wed May 17 11:43 - 10:39 (22:55) 
root pts/1 192.168.244.2 Mon Jun 13 19:19 - 11:24 (337+16:05) 
root pts/0 192.168.244.2 Mon Jun 13 18:57 - 11:24 (337+16:27) 
root pts/1 192.168.244.2 Mon Jun 13 08:55 - 18:45 (09:50) 
root pts/0 192.168.244.2 Mon Jun 13 03:59 - 10:45 (06:46) 
reboot system boot 2.6.32-573.el6.x Mon Jun 13 03:58 - 16:37 (339+12:39) 
root pts/1 192.168.244.2 Sun Jun 12 23:58 - down (03:59) 
root pts/0 192.168.244.2 Sun Jun 12 23:39 - 01:52 (02:13) 
root tty1 Sun Jun 12 23:28 - down (04:29) 
reboot system boot 2.6.32-573.el6.x Sun Jun 12 23:27 - 03:57 (04:30) 
root tty1 Sun Jun 12 23:26 - down (00:01) 
reboot system boot 2.6.32-573.el6.x Sun Jun 12 23:25 - 23:27 (00:01)  /var/log/btmp：当前系统上失败的登录尝试；
 lastb[root@server ~]# lastb
root ssh:notty 192.168.244.101 Thu May 18 16:33 - 16:33 (00:00) lastlog命令：显示当前系统每一个用户最近一次的登录时间；
例子：
[root@server ~]# lastlog 
Username Port From Latest
root pts/0 192.168.244.2 Thu May 18 16:37:34 +0800 2017
bin **Never logged in**
daemon **Never logged in**

####日志服务器如何完成（也就是如何作为收集其他机器日志信息的日志服务器）#############

环境：日志服务器：192.168.244.100

被收集服务器：192.168.244.101

#要成为rsyslog只需打开监听模块即可

[root@192.168.244.100 ~]# vim /etc/rsyslog.conf   #需要监听514端口，用udp还是tcp可自选
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514[root@server ~]# netstat -lntup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name 
tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 5407/rsyslogd 
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 2785/mysqld 
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 5112/vsftpd 
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 5239/sshd 
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1389/master 
tcp 0 0 :::514 :::* LISTEN 5407/rsyslogd 
tcp 0 0 :::22 :::* LISTEN 5239/sshd 
tcp 0 0 ::1:25 :::* LISTEN 1389/master 
udp 0 0 0.0.0.0:514 0.0.0.0:* 5407/rsyslogd 
udp 0 0 :::514 :::* 5407/rsyslogd[root@192.168.244.101 ~]# vi /etc/rsyslog.conf 
#*.info;mail.none;authpriv.none;cron.none  /var/log/messages
*.info;mail.none;authpriv.none;cron.none  @192.168.244.100     [root@192.168.244.101 ~]# service rsyslog restart 
[root@192.168.244.101 ~]# yum install -y vsftpd 
在rsyslog服务器的/var/log/message上可以看到：  
[root@192.168.244.100 ~]# tail -f /var/log/messages
May 18 05:19:29 localhost yum[5817]: Installed: vsftpd-3.0.2-21.el7.x86_64

注意点：如果有防火墙，需放行514端口

#####################如何让rsyslog服务器将日志记录到远端mysql数据库中#####################

环境：

mysql-server:192.168.244.101
rsyslog-server:192.168.244.100
[root@server ~]# ip addr|grep global
inet 192.168.244.100/24 brd 192.168.244.255 scope global eth0
 
[root@centos7 ~]# ip addr|grep inet|grep global
 inet 192.168.244.101/24 brd 192.168.244.255 scope global eno16777736 
 
[root@centos7 ~]# rpm -qa mariadb
mariadb-5.5.52-1.el7.x86_64[root@centos7 ~]# ss -tnl|grep 3306
LISTEN 0 50 *:3306 *:*[root@server src]# yum list all rsyslog*    #查看相关包，最主要的需要rsyslog-mysql 这个程序包，连接mysql的驱动
rsyslog-mysql.x86_64                                   5.8.10-10.el6_6                          base 
[root@server ~]# yum install -y rsyslog-mysql
[root@server ~]# rpm -ql rsyslog-mysql
/lib64/rsyslog/ommysql.so             #模块
/usr/share/doc/rsyslog-mysql-5.8.10
/usr/share/doc/rsyslog-mysql-5.8.10/createDB.sql    #mysql命令包，需要在mysql中运行[root@centos7 ~]# mysql        #登陆mysql-server 为sysloguser 这个用户授权
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 5
Server version: 5.5.52-MariaDB MariaDB ServerCopyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> grant all on Syslog.* to 'sysloguser'@'192.168.%.%' identified by 'syslogpass';
 
[root@centos7 ~]# vim /etc/my.cnf  #增加如下两行
[mysqld]skip_name_resolve = on
innodb_file_per_table = on[root@centos7 ~]# systemctl restart mariadb.service  #重启mysql-server
[root@server ~]# mysql -usysloguser -h192.168.244.101 -p    #在rsyslog服务器连接测试mysql-server中新建的用户可连接性
Enter password: 
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.5.52-MariaDB MariaDB ServerCopyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>
接下来导入下面的sql 包：
[root@server ~]# mysql -usysloguser -h192.168.244.101 -p < /usr/share/doc/rsyslog-mysql-5.8.10/createDB.sql   
[root@server ~]# mysql -usysloguser -h192.168.244.101 -p     #登陆mysql-server 查看操作是否成功，Syslog库是否建立
Enter password: 
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 5
Server version: 5.5.52-MariaDB MariaDB ServerCopyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| Syslog |
| test |
+--------------------+
3 rows in set (0.00 sec)mysql> use Syslog;
Database changed
mysql> show tables;
+------------------------+
| Tables_in_Syslog |
+------------------------+
| SystemEvents |
| SystemEventsProperties |
+------------------------+
2 rows in set (0.00 sec)mysql> desc SystemEvents;
+--------------------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+--------------------+------------------+------+-----+---------+----------------+
| ID | int(10) unsigned | NO | PRI | NULL | auto_increment |
| CustomerID | bigint(20) | YES | | NULL | |
| ReceivedAt | datetime | YES | | NULL | |
| DeviceReportedTime | datetime | YES | | NULL | |
| Facility | smallint(6) | YES | | NULL | |
| Priority | smallint(6) | YES | | NULL | |
| FromHost | varchar(60) | YES | | NULL | |
| Message | text | YES | | NULL | |
| NTSeverity | int(11) | YES | | NULL | |
| Importance | int(11) | YES | | NULL | |
| EventSource | varchar(60) | YES | | NULL | |
| EventUser | varchar(60) | YES | | NULL | |
| EventCategory | int(11) | YES | | NULL | |
| EventID | int(11) | YES | | NULL | |
| EventBinaryData | text | YES | | NULL | |
| MaxAvailable | int(11) | YES | | NULL | |
| CurrUsage | int(11) | YES | | NULL | |
| MinUsage | int(11) | YES | | NULL | |
| MaxUsage | int(11) | YES | | NULL | |
| InfoUnitID | int(11) | YES | | NULL | |
| SysLogTag | varchar(60) | YES | | NULL | |
| EventLogType | varchar(60) | YES | | NULL | |
| GenericFileName | varchar(60) | YES | | NULL | |
| SystemID | int(11) | YES | | NULL | |
+--------------------+------------------+------+-----+---------+----------------+
24 rows in set (0.00 sec)mysql> desc SystemEventsProperties;
+---------------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+---------------+------------------+------+-----+---------+----------------+
| ID | int(10) unsigned | NO | PRI | NULL | auto_increment |
| SystemEventID | int(11) | YES | | NULL | |
| ParamName | varchar(255) | YES | | NULL | |
| ParamValue | text | YES | | NULL | |
+---------------+------------------+------+-----+---------+----------------+
4 rows in set (0.01 sec)mysql>
 
##################接下里配置rsyslog服务器能使用mysql###################
[root@server ~]# vim /etc/rsyslog.conf     #编辑文件，在MODULES 里，增加一行
#### MODULES ####
$ModLoad ommysql
#### RULES ####
#*.info;mail.none;authpriv.none;cron.none                /var/log/messages
*.info;mail.none;authpriv.none;cron.none          :ommysql:192.168.244.101,Syslog,sysloguser,syslogpass
注释：:ommysql:192.168.244.101,Syslog,sysloguser,syslogpass   
 输出到mysql模块：mysql地址，数据库名，数据库登陆名，数据库登陆密码
[root@server ~]# /etc/init.d/rsyslog restart    #重启rsyslog
[root@server ~]# yum install -y zile   
[root@centos7 ~]# mysql    #mysql-server #查看安装zile是否有记录
MariaDB [Syslog]> select count(*) from SystemEvents;
+----------+
| count(*) |
+----------+
| 4 |
+----------+
1 row in set (0.01 sec)
MariaDB [Syslog]> select count(*) from SystemEventsProperties;
+----------+
| count(*) |
+----------+
| 0 |
+----------+
1 row in set (0.00 sec)MariaDB [Syslog]> select * from SystemEvents\G;
*************************** 1. row ***************************
 ID: 1
 CustomerID: NULL
 ReceivedAt: 2017-05-18 18:25:57
DeviceReportedTime: 2017-05-18 18:25:57
 Facility: 0
 Priority: 6
 FromHost: server
 Message: imklog 5.8.10, log source = /proc/kmsg started.
 NTSeverity: NULL
 Importance: NULL
 EventSource: NULL
 EventUser: NULL
 EventCategory: NULL
 EventID: NULL
 EventBinaryData: NULL
 MaxAvailable: NULL
 CurrUsage: NULL
 MinUsage: NULL
 MaxUsage: NULL
 InfoUnitID: 1
 SysLogTag: kernel:
 EventLogType: NULL
 GenericFileName: NULL
 SystemID: NULL
*************************** 2. row ***************************
 ID: 2
 CustomerID: NULL
 ReceivedAt: 2017-05-18 18:25:57
DeviceReportedTime: 2017-05-18 18:25:57
 Facility: 5
 Priority: 6
 FromHost: server
 Message: [origin software="rsyslogd" swVersion="5.8.10" x-pid="5626" x-info="http://www.rsyslog.com"] start
 NTSeverity: NULL
 Importance: NULL
 EventSource: NULL
 EventUser: NULL
 EventCategory: NULL
 EventID: NULL
 EventBinaryData: NULL
 MaxAvailable: NULL
 CurrUsage: NULL
 MinUsage: NULL
 MaxUsage: NULL
 InfoUnitID: 1
 SysLogTag: rsyslogd:
 EventLogType: NULL
 GenericFileName: NULL
 SystemID: NULL
*************************** 3. row ***************************
 ID: 3
 CustomerID: NULL
 ReceivedAt: 2017-05-18 18:28:51
DeviceReportedTime: 2017-05-18 18:28:51
 Facility: 1
 Priority: 6
 FromHost: server
 Message: Installed: gc-7.1-12.el6_4.x86_64
 NTSeverity: NULL
 Importance: NULL
 EventSource: NULL
 EventUser: NULL
 EventCategory: NULL
 EventID: NULL
 EventBinaryData: NULL
 MaxAvailable: NULL
 CurrUsage: NULL
 MinUsage: NULL
 MaxUsage: NULL
 InfoUnitID: 1
 SysLogTag: yum[5666]:
 EventLogType: NULL
 GenericFileName: NULL
 SystemID: NULL
*************************** 4. row ***************************
 ID: 4
 CustomerID: NULL
 ReceivedAt: 2017-05-18 18:28:51
DeviceReportedTime: 2017-05-18 18:28:51
 Facility: 1
 Priority: 6
 FromHost: server
 Message: Installed: zile-2.4.9-1.el6.x86_64
 NTSeverity: NULL
 Importance: NULL
 EventSource: NULL
 EventUser: NULL
 EventCategory: NULL
 EventID: NULL
 EventBinaryData: NULL
 MaxAvailable: NULL
 CurrUsage: NULL
 MinUsage: NULL
 MaxUsage: NULL
 InfoUnitID: 1
 SysLogTag: yum[5666]:
 EventLogType: NULL
 GenericFileName: NULL
 SystemID: NULL
4 rows in set (0.00 sec)

###################安装loganalyzer##################

[root@server ~]# yum install -y httpd php php-mysql  php-gd(后面数据统计，出图形需要用到)
[root@server ~]# netstat -ant
tcp        0      0 :::80                       :::*                        LISTEN 测试下php,与mysql的连通性：
[root@server ~]# cd /var/www/html/
You have new mail in /var/spool/mail/root
[root@server html]# ll
total 8
-rw-r--r-- 1 root root 329 May 18 18:45 index.php
-rw-r--r-- 1 root root 20 May 18 18:42 phpinfo.php
[root@server html]# cat phpinfo.php 
<?php
phpinfo();
?>
[root@server html]# cat index.php 
 <?php
 $conn = mysql_connect('192.168.244.101','sysloguser','syslogpass');
 if ($conn)
 echo "OK";
 else
 echo "Failure"; mysql_close();
 ?>[root@server ~]# curl 192.168.244.100/index.php      #可以连接上数据库
 OK
[root@server ~]# curl -I 192.168.244.100/phpinfo.php   #访问php页面OK
HTTP/1.1 200 OK

################安装LogAnalyzer#################

[root@server ~]# cd /usr/local/src/
[root@server src]# wget http://download.adiscon.com/loganalyzer/loganalyzer-3.6.5.tar.gz
[root@server src]# mv loganalyzer-3.6.5 /var/www/html/loganalyzer
[root@server src]# cd /var/www/html/loganalyzer/[root@server ~]# cd /var/www/html/loganalyzer/contrib/
[root@server contrib]# cat configure.sh 
#!/bin/shtouch config.php
chmod 666 config.php
[root@server contrib]# chmod +x *.sh [root@server contrib]# ./configure.sh      #让其生成config.php 文件
[root@server src]# chmod 666 config.php
[root@server src]# pwd 
/var/www/html/loganalyzer/src
[root@server src]# ll config.php
-rw-rw-rw- 1 root root 0 May 19 15:02 config.php

然后去浏览器操作：

rsync日志记录什么 rsyslog日志存放路径_数据库

rsync日志记录什么 rsyslog日志存放路径_运维_02

rsync日志记录什么 rsyslog日志存放路径_数据库_03

rsync日志记录什么 rsyslog日志存放路径_rsync日志记录什么_04

rsync日志记录什么 rsyslog日志存放路径_数据库_05

rsync日志记录什么 rsyslog日志存放路径_运维_06

完成！！！！！！！！！！！！！！！！！！

大致总结下过程：

配置使用基于mysql存储日志信息：
(1) 准备好MySQL服务器，创建用户，授权对Syslog数据库的全部访问权限；
(2) 安装rsyslog-mysql程序包；
(3) 创建rsyslog-mysql依赖的数据库；
# mysql -uUSERNAME -hHOST -pPASSWORD < /usr/share/doc/rsyslog-mysql-VERSION/createDB.sql
(4) 配置rsyslog使用ommysql模块

#### MODULES ####
 $ModLoad ommysql #### RULES ####
 facility.priority :ommysql:DBHOST,DB,DBUSER,USERPASS 重启rsyslog服务
 (5) 安装loganalyzer
 (a) 配置webserver, 支持php
 # yum install httpd php php-mysql php-gd
 # service httpd start
 (b) loganalyzer
 # cp -r loganalyzer-3.6.5/src /var/www/html/loganalyzer
 # cp loganalyzer-3.6.5/contrib/*.sh /var/www/html/loganalyzer
 # cd /var/www/html/loganalyzer
 # chmod +x *.sh
 # ./configure.sh
 # ./secure.sh
 # chmod 666 config.php

本文章为转载内容，我们尊重原作者对文章享有的著作权。如有内容错误或侵权问题，欢迎原作者联系我们进行内容更正或删除文章。