Linux 日志服务器搭建(rsyslog+loganalyzer)

环境 :centos 5.3 x32
日志服务器环境 :nginx php mysql rsyslog rsyslog-mysql loganalyzer
日志客户端环境:rsyslog
日志服务器        192.168.0.100

日志客户端服务器   192.168.0.101

一、nginx+php mysql 安装

nginx+php(fastcgi)+mysql 安装文档-1

nginx-0.7.62+php5.2.11(fastcgi)+mysql-5.1.39 安装文档

安装nginx

mysql 安装

php 安装

安装GD相关软件包

安装PHP相关软件包

创建php.ini文件

修改php.ini参数

配置php-fpm文件

启动FastCGI进程  

php相关软件包下载地址:http://www.chinasa.net/uploads/php-soft.rar
nginx下载地址:http://www.nginx.org/en/download.html
mysql下载地址:http://www.mysql.com/downloads/mysql/

 

nginx需要安装pcre库

# tar -zxvf pcre-7.8.tar.gz

# cd pcre-7.8

# ./configure   

# make && make install

 

nginx 安装

# tar zxvf nginx-0.7.62.tar.gz

# ./configure \

--prefix=/opt/nginx \

--with-http_stub_status_module

# make && make install

 

mysql安装

添加mysql组和mysql用户

# groupadd mysql

# useradd -g mysql mysql

编译与安装

# tar -zxvf mysql-5.1.39.tar.gz

# cd mysql-5.1.39

./configure \

--prefix=/opt/mysql \

--enable-assembler    \

--with-plugins=innobase,partition,myisam  \

--with-extra-charsets=none \

--enable-thread-safe-client \

--with-client-ldflags=-all-static \

--with-mysqld-ldflags=-all-static

# make && make install

 

mysql目录权限设置

 

# mkdir /opt/mysql/var

# mkdir /var/run/mysqld

# chmod +w /opt/mysql/

# chown -R mysql:mysql /opt/mysql/

# chown -R mysql:mysql /var/run/mysqld

 

添加mysql配置文件

# cp /opt/mysql/share/mysql/my-innodb-heavy-4G.cnf /etc/my.cnf

以mysql用户初始化数据库表

# /opt/mysql/bin/mysql_install_db --basedir=/opt/mysql --user=mysql

 

添加mysql启动/停止脚本

# cp /soft/mysql-5.1.39/support-files/mysql.server.sh  /etc/init.d/

# chmod 700 /etc/init.d/mysqld

# chkconfig --add mysqld

# chkconfig --level 345 mysqld on

 

也可以手动添加mysql自启动

# echo "/opt/mysql/bin/mysqld_safe --user=mysql &" >> /etc/rc.local

 

 

php安装

创建相应目录

# mkdir -p /opt/modules/jpeg7/man/man1

# mkdir /opt/modules/jpeg7/bin

# mkdir /opt/modules/jpeg7/lib

# mkdir /opt/modules/jpeg7/include

 

安装GD相关软件包

Libiconv安装

# tar zxvf libiconv-1.13.1.tar.gz

# cd libiconv-1.13.1/

# ./configure --prefix=/opt/modules/libiconv

# make && make install

 

   Freetype安装

       # cd freetype-2.3.10

# ./configure --prefix=/opt/modules/freetype

# make && make install

 

   Libpng 安装

       # tar zxvf libpng-1.2.40.tar.gz

# cd libpng-1.2.40

# cp scripts/makefile.std makefile

注:（64位系统下，需要修改makefile文件：找到CFLAGS=后加上-fPIC） 这里一定要修改，否则后面的php编译通不过

# make test && make install

 

   jpegsrc.v7 安装

       # tar zxvf jpegsrc.v7.tar.gz

# cd jpeg-7/

# ./configure --prefix=/opt/modules/jpeg7 \

--enable-shared \

--enable-static

# make && make install

 

   libxml2-sources 安装

       # tar zxvf libxml2-sources-2.6.30.tar.gz

# cd libxml2-2.6.30/

# ./configure --prefix=/opt/modules/libxml

# make && make install

 

安装GD

# tar zxvf gd-2.0.35.tar.gz

# cd gd-2.0.35

# ./configure --prefix=/opt/modules/gd \

  --with-jpeg=/opt/modules/jpeg7 \

  --with-png=/usr/local \

  --with-zlib \

  --with-freetype=/opt/modules/freetype

  注:64位要添加此选项 --enable-m4_pattern_allow

# make && make install

注: 安装php5需要gd2的支持，但在安装过程中，执行编译的时候出现

aclocal:configure.ac:64: warning: macro `AM_ICONV’ not found in library的错误,

搜索google得知安装gettext这个包就可以了。

＃yum install gettext gettext-devel

再执行make编译就好了。

nginx+php(fastcgi)+mysql 安装文档-2

Libmcrypt 安装

# tar zxvf libmcrypt-2.5.8.tar.gz

# cd libmcrypt-2.5.8/

# ./configure

# make && make install

# /sbin/ldconfig

# cd libltdl/

# ./configure --enable-ltdl-install

# make && make install

 

Mhash 安装

    # tar zxvf mhash-0.9.9.9.tar.gz

# cd mhash-0.9.9.9/

# ./configure

# make && make install

# cd ../

# ln -s /usr/local/lib/libmcrypt.la /usr/lib/libmcrypt.la

# ln -s /usr/local/lib/libmcrypt.so /usr/lib/libmcrypt.so

# ln -s /usr/local/lib/libmcrypt.so.4 /usr/lib/libmcrypt.so.4

# ln -s /usr/local/lib/libmcrypt.so.4.4.8 /usr/lib/libmcrypt.so.4.4.8

# ln -s /usr/local/lib/libmhash.a /usr/lib/libmhash.a

# ln -s /usr/local/lib/libmhash.la /usr/lib/libmhash.la

# ln -s /usr/local/lib/libmhash.so /usr/lib/libmhash.so

# ln -s /usr/local/lib/libmhash.so.2 /usr/lib/libmhash.so.2

# ln -s /usr/local/lib/libmhash.so.2.0.1 /usr/lib/libmhash.so.2.0.1

 

Mcrypt 安装

    # tar zxvf mcrypt-2.6.8.tar.gz

# cd mcrypt-2.6.8/

# /sbin/ldconfig

# ./configure --prefix=/opt/modules/mcrypt --with-libmcrypt-prefix=/usr/local --with-libiconv-prefix=/opt/modules/libiconv

# make && make install

 

Libevent 安装

    # tar zxvf libevent-1.4.12-stable.tar.gz

# cd libevent-1.4.12-stable

# ./configure --prefix=/opt/modules/libevent

# make && make install

 

解压php

    # tar -jxf php-5.2.11.tar.bz2

    # tar -zxf php-fpm-0.6-5.2.11.tar.gz  

 

生成php补丁   

    # ./php-fpm-0.6-5.2.11/generate-fpm-patch   #生成php补丁文件

    # patch -d php-5.2.11 -p1 < fpm.patch       #打补丁

    # cd php-5.2.11

    # ./buildconf –force     #这步必须执行，否则无法加with-fpm参数

    # mkdir fpm-build

    # cd fpm-build

    # ../configure --prefix=/opt/php \

        --with-config-file-path=/opt/php/etc \

        --enable-fastcgi \

        --with-fpm \

        --with-fpm-conf=/opt/php/etc/php-fpm.conf \

        --with-gd=/opt/modules/gd \

        --enable-gd-native-ttf \

        --enable-gd-jis-conv \

        --with-iconv-dir=/opt/modules/libiconv \

        --with-jpeg-dir=/opt/modules/jpeg7 \

        --with-zlib --with-png-dir=/usr/local \

        --with-freetype-dir=/opt/modules/freetype \

        --enable-mbstring \

        --with-libxml-dir=/opt/modules/libxml \

        --with-curl \

        --enable-zip \

        --enable-soap \

        --with-mcrypt \

        --with-mhash \

        --with-libevent=/opt/modules/libevent \

        --enable-xml \

        --enable-sockets  \

        --with-mysql=/opt/mysql

    # make && make install

 注:如需要添加myqli和mysql-pdo支持，可添加以下参数:

                 --with-mysqli=/opt/mysql/bin/mysql_config

　　　　 --with-pdo-mysql=/opt/mysql 

创建php.ini文件

# cp php.ini-dist /opt/php/etc/php.ini

修改php.ini参数

    # vi /opt/php/etc/php.ini

; Magic quotes for incoming GET/POST/Cookie data.

magic_quotes_gpc = Off  关闭魔术引号，避免特殊字符转义 

配置php-fpm文件

# vi /opt/php/etc/php-fpm.conf

注意修改以下几个参数：

Unix user of processes 

         <value name="user">www</value> 

Unix group of processes 

         <value name="group">www</value>

<value name="max_children">128</value>

<value name="rlimit_files">51200</value>

 

启动FastCGI进程

# /opt/php/bin/php-fpm start

其他控制命令

start 启动php的fastcgi进程

stop 强制终止php的fastcgi进程

quit 平滑终止php的fastcgi进程

restart 重启php的fastcgi进程

reload 重新加载php的php.ini

logrotate 重新启用log文件

#./configure \

# make

memcached php扩展安装 

memcached php安装

        --with-php-config=/opt/php/bin/php-config \

# make

修改php.ini配置文件

extension_dir = "/opt/php/lib/php/extensions/no-debug-non-zts-20060613/"
extension=memcached.so

        --with-php-config=/opt/php/bin/php-config \

imagick php扩展安装
imagick依赖于imagemagick库，先安装imagemagick库

http://pecl.php.net/get/imagick-2.3.0.tgz
# tar zxvf imagick-2.3.0.tgz
# cd imagick
# /opt/php/bin/phpize
# ./configure \

        --with-imagick=/opt/modules/imagemagick
# make

# vi /opt/php/etc/php.ini

extension=imagick.so

openssl php扩展安装

进入php软件目录
cd php/ext/openssl

#/usr/local/bin/phpize
<span class="Apple-style-span" trebuchet="" ms',="" verdana,="" arial,="" sans-serif;="" font-size:="" 16px;="" line-height:="" 24px;="" "="" style="padding: 0px; margin: 0px; "># ./configure --with-openssl --with-php-config=/opt/php/bin/php-config
<span class="Apple-style-span" trebuchet="" ms',="" verdana,="" arial,="" sans-serif;="" font-size:="" 16px;="" line-height:="" 24px;="" "="" style="padding: 0px; margin: 0px; "># make
# make install
修改php.ini配置文件
# vi /opt/php/etc/php.ini
extension=openssl.so

二、日志服务器安装(192.168.0.100)
# yum install rsyslog rsyslog-mysql
配置
# vi /etc/rsyslog
添加以下几行
$ModLoad immark   # provides --MARK-- message capability 
$ModLoad ommysql 
*.*       :ommysql:localhost,Syslog,root,pass
$ModLoad imudp.so  # provides UDP syslog reception 
$UDPServerRun 514  # start a UDP syslog server at standard port 514 

注：*.*       :ommysql:localhost,Syslog,root,pass
localhost 为mysql主机地址
Syslog    为mysql数据库
root      为mysql用户名
pass      为mysql用户root密码

$UDPServerRun 514  # UDP端口，接受客户端日志

导入数据库
# mysql < /usr/share/doc/rsyslog-mysql-3.22.1/createDB.sql

注:createDB.sql 文件里有自动创建Syslog数据库
三、启动rsyslog日志服务器
# /etc/init.d/syslog stop      停止syslog日志
# /etc/init.d/rsyslog start     启动rsyslog日志
将rsyslog设置开机启动
# chkconfig --level 3 syslog off 

停止syslog开机启动
# chkconfig --level 3 rsyslog on  启用 rsyslog开机启动

四、安装loganalyzer服务器
# tar zxvf loganalyzer-3.2.1.tar.gz
# cp -rf /root/loganalyzer-3.2.1/src/* /var/html/syslog
注:/var/html/syslog 为web服务器目录

# cd /var/html/syslog
创建config.php配置文件
# touch config.php
# chmod 666 config.php

启动nginx
# /opt/nginx/sbin/nginx
在IE里输入http://192.168.0.100 进行loganalyzer配置
按提示下一步.下一步操作
注:注意数据库表名分大小写.应该写为 SystemEvents

五、日志服务器客户端安装
# yum install rsyslog
# vi /etc/rsyslog
添加如下内容
*.*   @192.168.0.100
注:192.168.0.100 为日志服务器端IP地址

六、相关载图