rsyslog+loganalyzer+evtsys搭建集中式监控系统

一、服务端的安装

YUM源新建，如果有的话，可以省略

1. # cat >> /etc/yum.repos.d/sohu.repo <<EOF

2. [sohu]

3. name=sohu's mirrors

4. baseurl=http://mirrors.sohu.com/centos/5/os/x86_64/

5. enabled=1

6. gpgcheck=0

7. EOF

安装LAMP环境及rsyslog，如果有LAMP，只需要安装rsyslog rsyslog-mysql即可

1. yum install rsyslog rsyslog-mysql mysql mysql-devel mysql-server php php-mysql php-pdo php-common php-gd httpd

导入rsyslog数据库

1. mysql -u root -p < $(rpm -ql rsyslog-mysql | grep sql$)

创建数据库用户

1. mysql -u root -p

2. mysql> grant all privileges on Syslog.* to logger@localhost identified by 'logger';

3. mysql> flush privileges;

4. mysql> exit;

修改rsyslog的配置文件

1. # vi /etc/rsyslog.conf     //修改一下即可

2. # Use traditional timestamp format

3. $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

5. # Provides kernel logging support (previously done by rklogd)

6. # Provides support for local system logging (e.g. via logger command)

7. $ModLoad immark

8. $ModLoad imuxsock

9. $ModLoad imklog

11. $ModLoad ommysql

12. *.* :ommysql:127.0.0.1,Syslog,logger,logger

14. $ModLoad imudp.so

15. $UDPServerRun 514

17. # Log all kernel messages to the console.

18. # Logging much else clutters up the screen.

19. #kern.*                                                 /dev/console

20. # Log anything (except mail) of level info or higher.

21. # Don't log private authentication messages!

22. *.info;mail.none;authpriv.none;cron.none                /var/log/messages

23. # The authpriv file has restricted access.

24. authpriv.*                                              /var/log/secure

25. # Log all the mail messages in one place.

26. mail.*                                                  -/var/log/maillog

27. # Log cron stuff

28. cron.*                                                  /var/log/cron

30. # Everybody gets emergency messages

31. *.emerg                                                 *

32. # Save news errors of level crit and higher in a special file.

33. uucp,news.crit                                          /var/log/spooler

35. # Save boot messages also to boot.log

36. local7.*                                                /var/log/boot.log

红色部分是添加的，其它的对比一下，有的就略过，没的就添加一下吧。

安装LogAnalyzer

1. # wget http://download.adiscon.com/loganalyzer/loganalyzer-3.6.3.tar.gz

2. # tar xf loganalyzer-3.6.3.tar.gz

3. # mkdir /var/www/html/loganalyzer

4. # mv loganalyzer-3.6.3/src/* /var/www/html/loganalyze

5. # touch /var/www/html/loganalyzer/config.php

6. # chmod 666 /var/www/html/loganalyzer/config.php

通过浏览器安装即可

以上就完成了loganalyzer的安装，登陆查看

二、Windows客户端安装

下载evtsys  http://code.google.com/p/eventlog-to-syslog/

1. 解压缩放到 C:\Windows\System32

2. evtsys -i -s 10 -h log-server-ip -p 514

3. net start evtsys

在安装的时候，会报一个错误，是配置文件的问题，可以忽略不用管，只要看到最后的安装成功即可。以下附上详细的参数

1. Version: 4.4 (32-bit)

2. Usage: evtsys.exe -i|-u|-d [-h host] [-b host] [-f facility] [-p port]

3.       [-s minutes] [-l level] [-n]

4.  -i           Install service

5.  -u           Uninstall service

6.  -d           Debug: run as console program

7.  -h host      Name of log host

8.  -b host      Name of secondary log host (optional)

9.  -f facility  Facility level of syslog message

10.  -l level     Minimum level to send to syslog.\n", stderr);

11. 0=All/Verbose, 1=Critical, 2=Error, 3=Warning, 4=Info

12.  -n           Include only those events specified in the config file.

13.  -p port      Port number of syslogd

14.  -q bool      Query the Dhcp server to obtain the syslog/port to log to

15.               (0/1 = disable/enable)

16.  -s minutes   Optional interval between status messages. 0 = Disabled

18. Default port: 514

19. Default facility: daemon

20. Default status interval: 0

21. Host (-h) required if installing.

以下是在Loganalyzer上看到的Windows的日志，很明显的windows日志。监控Linux日志就很简单了，直接修改配置文件，把日志发送一份到日志服务器即可，这里不再详细的说明。

本文出自 “吖吖個呸” 博客，请务必保留此出处http://gm100861.blog.51cto.com/1930562/1191164