LogAnalyzer日志系统

简介

LogAnalyzer是一款Web界面syslog日志分析工具,它提供对日志的简单浏览、搜索、基本分析和一些图表报告的功能。

客户端

 Evtsys是一种可以将Windows日志转换为syslog格式并发送到日志服务器的工具。

windows 客户端安装

将下载的Evtsys文件，复制到系统目录C:\Windows\System32下

打开cmd命令行使用命令安装evtsys

C:\Windows\System32> evtsys -i -h 192.168.245.140(日志服务器地址)  #-i是安装在windows -h是syslog服务器地址
C:\Windows\System32> net start evtsys  #启动服务

Linux 客户端

yum -y install epel-*
yum -y install nginx php-fpm rsyslog
yum -y install mariadb-server mariadb rsyslog
yum install mysql-server mysql-devel httpd php-mysql php php-gd php-xml -y

 rsyslog日志收集验证

tail /var/log/messages

环境配置

软件包安装

yum -y install epel-*
yum -y install nginx php-fpm 
yum -y install mariadb-server mariadb 
yum install mysql-server mysql-devel httpd php-mysql php php-gd php-xml -y

数据库安装

systemctl start mariadb && systemctl enable mariadb #启动服务
mysql
MariaDB [(none)]> use mysql;
MariaDB [mysql]> update user set password=password('admin123') where user='root'；   # 修改root密码
MariaDB [mysql]> GRANT ALL ON Syslog.* TO 'Syslog'@'192.168.%.%'IDENTIFIED BY 'admin123';   # 授权syslog
MariaDB [mysql]> FLUSH PRIVILEGES;
MariaDB [mysql]> \q

 查看上面的数据库名称和syslog数据库用户

less /usr/share/doc/rsyslog-8.24.0/mysql-createDB.sql
CREATE DATABASE Syslog;
USE Syslog;
CREATE TABLE SystemEvents;

 重定向导入Syslog数据库

mysql -uSyslog -h192.168.245.140 -p'admin123' < /usr/share/doc/rsyslog-8.24.0/mysql-createDB.sql

修改配置文件

vim /etc/rsyslog.conf
$ModLoad ommysql
*.info;mail.none;authpriv.none;cron.none :ommysql:192.168.245.140,Syslog,Syslog,admin123

systemctl restart rsyslog #修改完配置重启rsyslog服务

 loganalyzer服务配置

wget http://download.adiscon.com/loganalyzer/loganalyzer-4.1.10.tar.gz  #下载loganalyzer文件
ls
anaconda-ks.cfg  loganalyzer-4.1.10.tar.gz
tar -xf loganalyzer-4.1.10.tar.gz #解压
mkdir /loganalyzer
cp -r loganalyzer-4.1.10/src/* /loganalyzer
cp loganalyzer-4.1.10/contrib/* /loganalyzer
cd /loganalyzer
chmod +x *.sh
./configure.sh
./secure.sh
chmod 666 config.php

修改nginx配置文件，添加虚拟主机

vim /etc/nginx/conf.d/default.conf
server {
        listen  80;
        server_name 192.168.245.140;
        index index.html index.htm index.php;
        charset utf-8;
        root /loganalyzer;
        location / {
                #max_fails=6;
                #fail_timeout=60;
                root /loganalyzer;
        }

        location ~.*\.php$ {
                fastcgi_connect_timeout 300;
                root /loganalyzer;
                fastcgi_send_timeout 300;
                fastcgi_read_timeout 300;
                #max_fails=6;
                #fail_timeout=60;
                fastcgi_buffers 8 16k;
                fastcgi_buffer_size 32k;
                #fastcgi_pass unix:/dev/shm/php-fpm.sock;
                fastcgi_pass 127.0.0.1:9000;
                fastcgi_index index.php;
                fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
                include fastcgi_params;
                try_files $uri = 404;
        }
}

 重启服务

systemctl restart nginx && systemctl restart php-fpm

 LogAnalyzer 登录