rsyslog+loganalyzer配置日志监控服务器收集(linux+windows)日志

系统要求：

mysql mysql- devel mysql-server php php-mysql php-pdo php- common php-gd httpd

系统要求按照：

root#yum

install

mysql

mysql-devel

mysql-server

php

php-mysql

php-pdo

php-common php-gd httpd

Mysql

数据库的安装配置：

1.

安装

mysql

1.1

执行安装

$$sudo yum -y install mysql- server

1.2

注意

mysql

和

mysql-serve r

有区别，只需作为

client

，执 行

yum install mysql.

2.

服务和配置

2.1

开机启动

$$ sudo /sbin/chkconfig --add mysqld

$$ sudo /sbin/chkconfig mysqld on

$$ sudo /sbin/service mysqld start

2.2

设置

root

密码

$$sudo mysqladmin -u root password '1234'

3.

连接

mysql

$$mysql -h localhost -uroot -p1234

2

< br>、下载

rsyslog+loganalyzer

rsyslog

下载地址：

/download/

Logandale

下载地址：

/downloads

3

、前期环境部署

yum -y install mysql-devel

这个不安装的话，在编译

rsysl og

时会出错的。

4

、解压，进入按照目录安装

rsyslog

tar -zxvf

Cd rsyslog-x.x.x

./configure --enable- mysql

make && make install

cp /etc

#

此文件在编译目录下

5

、

vim /etc/

#

修改配置文件

# if you experience problems, check

# /troubleshoot for assistance

# rsyslog v3: load input modules

# If you do not load inputs, nothing happens!

# Y

ou may need to set the module load path if modules are not found.

$$ModLoad immark

# provides --MARK-- message capability

$$ModLoad imuxsock # provides support for local system logging (e.g. via logger

command)

$$ModLoad imklog

# kernel logging (formerly provided by rklogd)

=================

新增下面

2

行

== ==============

$$ModLoad ommysql

*.*

:ommysql:localhost,Syslog,r oot,mysql

#

注

localhost

字节是

database-server

# Syslog

是数据中

database-name

# root

是

database-userid

# mysql

是

root

用户登录

mysql

的密码

#

该行的格式

#*.*

:ommysql:database- server,database-name,database-userid,database- password

#

同

样

要

注

意

的

是

database-name

须

和

/usr/sha re/doc/rsyslog-mysql-[version]/

中的相同

============ ================================

主要是加载

mysql

数据库。

# Log all kernel messages to the console.

# Logging much else clutters up the screen.

#kern.*

/dev/console

# Log anything (except mail) of level info or higher.

# Don't log private authentication messages!

*.info;;;

-/var/log/messages

# The authpriv file has restricted access.

authpriv.*

/var/log/secure

# Log all the mail messages in one place.

mail.*

-/var/log/maillog

# Log cron stuff

cron.*

-/var/log/cron

# Everybody gets emergency messages

*.emerg

*

# Save news errors of level crit and higher in a special file.

uucp,

-/var/log/spooler

# Save boot messages also to

local7.*

/var/log/

# Remote Logging (we use TCP for reliable delivery)

# An on-disk queue is created for this action. If the remote host is

# down, messages are spooled to disk and sent when it is up again.

#$$WorkDirectory /rsyslog/spool # where to place spool files

#$$ActionQueueFileName uniqName # unique name prefix for spool files

#$$ActionQueueMaxDiskSpace 1g

# 1gb space limit (use as much as possible)