码迷,mamicode.com
首页 > 其他好文 > 详细

安装syslog-ng管理日志

时间:2014-09-26 01:33:48      阅读:417      评论:0      收藏:0      [点我收藏+]

标签:需爱交流解决的文档

安装了syslog-ng统一管理服务器日志,安装方法是网上找的,现在有些问题需要解决;

1.日志服务器可以同步日子,但是由于要自定义管理想要的日志文件,一直不能同步到服务器,现在贴出配置文档,希望可以交流学习。


安装syslog-ng


service 端安装:

yum install gcc*  

cd /usr/src 

wget http://www.balabit.com/downloads/files/syslog-ng/sources/3.2.4/source/eventlog_0.2.12.tar.gz 

wget http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.3.5/source/syslog-ng_3.3.5.tar.gz 

tar xvf eventlog_0.2.12.tar.gz 

cd eventlog-0.2.12 

./configure --prefix=/usr/local/eventlog 

make 

make install 

 

cd /usr/src 

tar xvf syslog-ng_3.3.5.tar.gz 

cd syslog-ng-3.3.5 

export PKG_CONFIG_PATH=/usr/local/eventlog/lib/pkgconfig 

./configure --prefix=/usr/local/syslog-ng 

make 

make install 

 

 

将syslog-ng添加为系统服务, 

vim /etc/init.d/syslog-ng  #内容如下 

#!/bin/bash 

#  

# chkconfig: -  60 27 

# description: syslog-ng SysV script.  

. /etc/rc.d/init.d/functions 

 

syslog_ng=/usr/local/syslog-ng/sbin/syslog-ng 

prog=syslog-ng 

pidfile=/usr/local/syslog-ng/var/syslog-ng.pid 

lockfile=/usr/local/syslog-ng/var/syslog-ng.lock 

RETVAL=0 

STOP_TIMEOUT=${STOP_TIMEOUT-10} 

 

start() { 

        echo -n $"Starting $prog: " 

        daemon --pidfile=$pidfile $syslog_ng $OPTIONS 

        RETVAL=$? 

        echo 

        [ $RETVAL = 0 ] && touch ${lockfile} 

        return $RETVAL 

 

stop() { 

    echo -n $"Stopping $prog: " 

    killproc -p $pidfile -d $STOP_TIMEOUT $syslog_ng 

    RETVAL=$? 

    echo 

    [ $RETVAL = 0 ] && rm -f $lockfile $pidfile 

 

case "$1" in 

  start) 

    start 

    ;; 

  stop) 

    stop 

    ;; 

  status) 

        status -p $pidfile $syslog_ng 

    RETVAL=$? 

    ;; 

  restart) 

    stop 

    start 

    ;; 

  *) 

    echo $"Usage: $prog {start|stop|restart|status}" 

    RETVAL=2 

esac 

exit $RETVAL 

------------------------------------------------------------ 

chmod a+x /etc/init.d/syslog-ng 

killall syslogd 

chkconfig --add syslog-ng 

chkconfig syslog-ng on 

service syslog-ng start 


 配置文件/usr/local/syslog-ng/etc/syslog-ng.conf

#下文为完整配置文件,注意:


@version:3.3.5

@include "scl.conf"

options {

#long_hostnames(off);

log_msg_size(8192);

flush_lines(1);

log_fifo_size(20480);

time_reopen(10);

use_dns(yes);

dns_cache(yes);

use_fqdn(yes);

keep_hostname(yes);

chain_hostnames(no);

#chain_hostnames(off);

perm(0644);

stats_freq(43200);

};

source s_internal { internal(); };

destination d_syslognglog { file("/var/log/syslog-ng.log"); };

log { source(s_internal); destination(d_syslognglog); };

source s_local {

        unix-dgram("/dev/log");

         file("/proc/kmsg"program_override("kernel:"));

};

#定义7种日志类型

filter f_messages { level(info..emerg); };

filter f_secure { facility(authpriv); };

filter f_mail { facility(mail); };

filter f_cron { facility(cron); };

filter f_emerg { level(emerg); };

filter f_spooler { level(crit..emerg) and facility(uucp, news); };

filter f_local7 { facility(local7); };

filter f_local4 { facility(local4); };

#定义7种类型日志在客户端的位置

destination d_messages { file("/var/log/messages"); };

destination d_secure { file("/var/log/secure"); };

destination d_maillog { file("/var/log/maillog"); };

destination d_cron { file("/var/log/cron"); };

destination d_console { usertty("root"); };

destination d_spooler { file("/var/log/spooler"); };

destination d_bootlog { file("/var/log/dmesg"); };

destination d_usercmd { file("/var/log/usercmd.log"); };

log { source(s_local); filter(f_emerg); destination(d_console); };

log { source(s_local); filter(f_secure); destination(d_secure); flags(final);};

log { source(s_local); filter(f_mail); destination(d_maillog); flags(final); };

log { source(s_local); filter(f_cron); destination(d_cron); flags(final); };

log { source(s_local); filter(f_spooler); destination(d_spooler); };

log { source(s_local); filter(f_local7); destination(d_bootlog); };

log { source(s_local); filter(f_messages); destination(d_messages); };

log { source(s_local); filter(f_local4); destination(d_usercmd); };

#定义监听的端口

# Remote logging

source s_remote {

         tcp(ip(0.0.0.0)port(514));

         udp(ip(0.0.0.0) port(514));

};


#定义客户端日志在服务器上保存的格式,位置和权限等

destination r_console{file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/console"owner("root") group("root") perm(0640) dir_perm(0750)create_dirs(yes));};

destination r_secure{file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/secure" owner("root")group("root") perm(0640) dir_perm(0750) create_dirs(yes));};

destination r_cron{file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/cron"owner("root") group("root") perm(0640) dir_perm(0750)create_dirs(yes));};

destination r_spooler {file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/spooler"owner("root") group("root") perm(0640) dir_perm(0750)create_dirs(yes));};

destination r_bootlog{file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/bootlog"owner("root") group("root") perm(0640) dir_perm(0750)create_dirs(yes));};

destination r_messages{file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/messages"owner("root") group("root") perm(0640) dir_perm(0750)create_dirs(yes));};

destination r_usercmd{file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/usercmd"owner("root") group("root") perm(0640) dir_perm(0750)create_dirs(yes));};

destination r_maillog{file("/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/maillog"owner("root") group("root") perm(0640) dir_perm(0750)create_dirs(yes));};

log { source(s_remote); filter(f_emerg); destination(r_console); };

log { source(s_remote); filter(f_secure); destination(r_secure); flags(final);};

log { source(s_remote); filter(f_cron); destination(r_cron); flags(final); };

log { source(s_remote); filter(f_spooler); destination(r_spooler); };

log { source(s_remote); filter(f_local7); destination(r_bootlog); };

log { source(s_remote); filter(f_messages); destination(r_messages); };

log { source(s_remote); filter(f_local4); destination(r_usercmd); };

log { source(s_remote); filter(f_mail); destination(r_usercmd); };



#############################################3


注:如果要新加监控的服务log,需要添加几个地方:标红的配置文件

在client 端加入

local4.* /var/log/usercmd.log



#  /usr/local/syslog-ng/sbin/syslog-ng -e -F -d -v

测试syslog-ng配置文件是否正确


Client 端 我们使用rsyslog系统自带收集log服务

vi /etc/rsyslog.conf

最下边加入一行

*.info                   @10.0.11.53




  vi /etc/syslog.conf

   添加如下:

   *.info;mail.none;news.none;authpriv.none;cron.none @service ip


安装syslog-ng管理日志

标签:需爱交流解决的文档

原文地址:http://838853.blog.51cto.com/828853/1558207

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!