※ 각시스템 로그를 로그통합서버에 원격 보관하고 웹에서 모니터링하는 방법입니다.
원격로그 설정이 되어있는 서버는 통합서버에 로그을 기록하며 통합서버에서는 MYSQL DB로 저장관리하는 방식입니다.
1. 로그 통합서버
# yum -y install rsyslog rsyslog-mysql
# yum mysql* php53* httpd*
# chkconfig rsyslog on
# service rsyslog start
1) mysql 설정
- 데이타 초기화
# mysql -u root < /usr/share/doc/rsyslog-mysql-3.22.1/createDB.sql
- 권한 및 유저 생성
mysql> create user 'rsyslog'@'localhost' identified by 'rsyslog';
mysql> grant all on Syslog.* to 'rsyslog'@'localhost' with grant option;
mysql> flush privileges;
mysql> exit;
2) rsyslog 설정
# cat /etc/rsyslog.conf
# Use traditional timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Provides kernel logging support (previously done by rklogd)
$ModLoad imklog
# Provides support for local system logging (e.g. via logger command)
$ModLoad imuxsock
$UDPServerRun 514
$ModLoad ommysql.so
$template dbFormat,"insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%FROMHOST%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL
*.info;mail.none;authpriv.none;cron.none :ommysql:localhost,Syslog,rsyslog,rsyslog;dbFormat
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
# /etc/sysconfig/rsyslog
SYSLOGD_OPTIonS="-r -m 0"
3). 웹서버 설정
# wget http://download.adiscon.com/loganalyzer/loganalyzer-3.5.1.tar.gz
# tar zxvf loganalyzer-3.5.1.tar.gz
# mv ./loganalyzer-3.5.1/src /var/www/html/syslog
# mv ./loganalyzer-3.5.1/contrib/* /var/www/html/syslog
# cd /var/www/html/syslog
# chmod u+x configure.sh secure.sh
# ./configure.sh
