syslog-ng
http://www.balabit.com/
可依log內容以regular expression自訂分類及處理方式
支援tcp/udp將log送到遠端server
可即時通知在線上的系統管理者
可將log值當成某個program的標準輸入字串，直接將log作加工及分析
syslog-ng下載位置
http://www.balabit.com/downloads/files/syslog-ng/sources/
安裝syslog-ng之前的準備
必裝的有:
libol http://www.balabit.com/downloads/files/libol
eventlog http://www.balabit.com/downloads/files/eventlog
……………………….
安裝libol
#tar -zxvf libol-< version >.tar.gz
#cd libol-< version >
#./configure –prefix=/usr/local/libol –enable-shared
#make
#make install
安裝eventlog
#tar -zxvf eventlog-< version >.tar.gz
#cd eventlog-< version >
#./configure –prefix=/usr/local/eventlog
#make
#make install
安裝syslog-ng
#tar -zxvf syslog-ng-< version >.tar.gz
#cd syslog-ng-< version >
#export PKG_CONFIG_PATH=/usr/local/eventlog/lib/pkgconfig/
#./configure –prefix=/usr/local/syslog-ng –with-libol=/usr/local/libol
#make
#make install
測試
啟動syslog-ng
#/usr/local/syslog-ng/sbin/syslog-ng -f < syslog-ng.conf path>
ps:
接收外部主機log
需在syslog-ng.conf中設定如下
source s_network { udp(); }; #加入該行以接收udp port514
destination d_local { file(“/var/log/messages”);}; #這行預設會有
log{source(s_network);destination(d_local);}; #加入該行讓來源寫入目地messages
ps:詳細請看syslog-ng.conf補充
##########################################################
syslog-ng.conf
結構如下
設定全域參數,
格式為options { function1() [;function2(),…] };
常見的function有
chain_hostnames(no);
create_dirs (no);
dir_perm(0755);
dns_cache(yes);
keep_hostname(yes);
log_fifo_size(2048);
log_msg_size(8192);
long_hostnames(on);
perm(0644);
stats(3600);
sync(0);
time_reopen (10);
use_dns(yes);
use_fqdn(yes);
create_dirs(yes); #若目錄不存在則建立
owner(root); #指定建立檔案擁有者
group(root); #指定建立檔案的群組
perm(0600); #指定建立檔案的權限
dir_perm(0700); #指定目錄權限
設定input來源,
格式為source source_ name { function1() [;function2(),…] };
常見的function有
internal()表所有本機產生的log
unix-stream(“/dev/log”)表來自本機的log檔,本機是Linux
file(“/proc/kmsg”); 表示核心log
tcp();從tcp接收log
udp();從udp接收log
ex:
source src {
unix-stream(“/dev/log”); # local system logs
internal(); # internal syslog-ng logs
file(“/proc/kmsg”); # local kernel logs
};
source remote { tcp(ip(“127.0.0.1”) port(514) keep-alive(yes)); }; #監聽tcp port514接收log
source remote { udp(); }; #監聽udp,預設514port接收log
設定output目的地,
格式為destination destination_ name {function1() [;function2(),…] };
常見的function有
file(“path”):以檔案的方式存在local端
usertty(“user_name”):即時通知特定的線上的使用者
unix-dgram < filename>:writes messages to the given AF_UNIX, SOCK_DGRAM socket (BSDi style)
unix-stream < filename>:writes messages to the given AF_UNIX, SOCK_STREAM socket (Linux style)
udp < ip>,< port>:network destination using the UDP protocol
tcp < ip>,< port>:network destination using the TCP protocol
ex:
destination lpr { file(“/var/log/lpr.log”); };
destination mail { file(“/var/log/mail.log”); };
destination messages { file(“/var/log/messages”); };
destination console { usertty(“root”); };
設定filter條件
格式為filter filter_name{function1() [;function2(),…] };
#facility(string1,string2):篩選出包含string1或string2其中之一個字串的log.
#level(S1..S2..S3) or priority(S1..S2..S3),篩選出包含其中之一level的log
將設定好的source,filter,destination依需求作組合
格式為log { source_name( ); [ filter_name(f_emergency);] destination_name( ); };
ex:
log { source(src); filter(f_lpr); destination(lpr); };
log { source(src); filter(f_mail); destination(mail); };
log { source(src); filter(f_messages); destination(messages); };
log { source(src); filter(f_emergency); destination(console); };
##########################################################
將log匯入資料庫並透過網頁檢索
必裝的有:
php-syslog-ng http://sourceforge.net/projects/php-syslog-ng/
php,apache,mysql
安裝步驟如下
1
php-syslog-ng
解壓縮後移到網頁目錄下,並開啟指定的網頁,依照指示完成安裝
http:///syslogng/install/index.php
安裝完後會有以下
1php-syslog-ng管理相關資料
2建立指定的database
3建立具名管線在/var/log/mysql.pipe
若沒建可自行手動建:mkfifo /var/log/mysql.pipe
2
設定具名管線(此部份在每次重開機時都要執行)
#mysql -u syslogfeeder –password=< pass > < database > < /tmp/mysql.pipe >/dev/null &
輸入從phpsyslog安裝時帳戶syslogfeeder的< pass >和指定的< database>
3
修改syslog-ng.conf後重啟syslog-ng
destination d_mysql {
pipe(“/var/log/mysql.pipe”
template(“INSERT INTO logs
(host, facility, priority, level, tag, datetime, program, msg)
VALUES ( ‘$HOST’, ‘$FACILITY’, ‘$PRIORITY’, ‘$LEVEL’, ‘$TAG’, ‘$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC’,
‘$PROGRAM’, ‘$MSG’ );n”) template-escape(yes));
};
log { source(net); destination(d_mysql);};
……………………………………………………………………………………………………………………
參考資料
http://wangchengtai.blog.hexun.com.tw/24382350_d.html
http://zoukejian.blog.51cto.com/131276/56828
http://samlin2004.myweb.hinet.net/docs/log/syslog-ngInstallationGuide.htm
http://ssorc.tw/rewrite.php/read-203.html
http://forum.icst.org.tw/phpbb/viewtopic.php?t=348
http://blog.xuite.net/lianyijyi/it/27833426