How to use rsyslog+mysql
This article mainly shows you "how to use rsyslog+mysql", the content is easy to understand, clear, hope to help you solve your doubts, the following let the editor lead you to study and learn "how to use rsyslog+mysql" this article.
1. Install MySQL
A.. / configure-prefix=/usr/local/mysql-with-charset=utf8
B. Make install
two。 Configure MySQL and add a write-only account and a read-only account. The write-only account is for rsyslog to log to mysql, and the read-only account is for the front-end web page.
GRANT INSERT ON Syslog.* TO 'rsyslog_write'@'localhost' IDENTIFIED BY' password_123456'
GRANT SELECT ON Syslog.* TO 'rsyslog_read'@'localhost' IDENTIFIED BY' password_234567'
3. Install rsyslog
A. the latest version on http://www.rsyslog.com/
B. PATH=$ PATH:/usr/local/mysql/bin # because MySQL is installed manually and is not in the environment variable, while the configure of rsyslog looks for the lib of MySQL from the environment variable
C. / configure-- prefix=/usr/local/rsyslog-- enable-mysql # turn on MySQL support, write the log to MySQL and display it directly on the front-end web, report
D. Make install
E. Mysql-u root-p
< ./plugins/ommysql/createDB.sql # 导入db结构 f. Cp rsyslog.conf /etc/ # 默配置文件 g. ln -s /usr/local/rsyslog/sbin/rsyslogd /sbin/rsyslogd # 这一步可用可不用 4. 配置rsyslog a. 在/etc/rsyslog.conf最上面加上$ ModLoad ommysql 载入mysql支持的模块 b. 去掉/etc/rsyslog.conf内以下两行前的#号，打开udp监听端口 $ ModLoad imudp.so # provides UDP syslog reception $ UDPServerRun 514 # start a UDP syslog server at standard port 514 c. 增加/etc/rsyslog.conf下面两行，将local7和user的日志写到mysql中 local7.* :ommysql:127.0.0.1,Syslog,rsyslog_write,password_123456 user.* :ommysql:127.0.0.1,Syslog,rsyslog_write,password_123456 d. 去掉链接错的日志示例 :msg, contains, "error: connect" ~ 5. 替换syslog 为rsyslog a. 由于rsyslog没有附带启动脚本，我做了如下修改 b. Cp /etc/init.d/syslog /etc/init.d/syslogd #保留老的的syslog启动文件，以备要恢复时使用 c. 编辑/etc/init.d/syslog 将里面路径有关的全改成/usr/local/rsyslog/sbin/rsyslogd 如果你上面3.g这一步做了链接，就可以只把syslog改为rsyslogd d. 这样修改完后就是先停掉老的syslog，再启用新的rsyslog了 e. /etc/init.d/syslogd stop; # 停掉系统自带的 f. /etc/init.d/syslog start # 启用新的rsyslog 6. 修改iptables ，增加udp54端口出入，防止被人强x a. Iptables -A RH-Firewall-1-INPUT -s 1.2.0.0/255.255.0.0 -p udp -m udp --dport 514 -j ACCEPT b. Iptables -A RH-Firewall-1-INPUT -s 3.4.0.0/255.255.0.0 -p udp -m udp --dport 514 -j ACCEPT 7. 安装logcon a. http://www.phplogcon.org/ 上下载最新版本 b. 解压到某个目录，并配置好apache的vhost，这些步骤就不写了，比较平常的操作 c. 访问http://127.0.0.1/install.php 安装，填上的账号和密码就行了，其他选项都默认。 8. 配置日志客户端 a. 在web服务器上echo 'kern.*;user.* @1.2.3.4' >> / etc/syslog.conf
B. / etc/init.d/syslog reload # restart syslogd
The above is all the contents of this article "how to use rsyslog+mysql". Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!
