http://www.ituring.com.cn/article/128536
1、数据库修改
LogAnalyzer 默认表字段只有一个 FromHost,我们在添加一个 FromIP,用于记录源IP地址。
mysql> use Syslog;
mysql> alter table SystemEvents add FromIP varchar(60) default null after FromHost;
2、修改rsyslog.conf
rsyslog 默认情况下插入语句没有 FromIP字段,我们修改插入SQL 语句添加 FromIP字段即可。
$template insertpl,"insert into SystemEvents (Message, Facility, FromHost, FromIP, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', '%fromhost-ip%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL $ModLoad ommysql *.* :ommysql:localhost,Syslog,rsyslog,syslog;insertpl #应用上面SQL语句,template在ModLoad上面
3、LogAnalyzer添加源IP地址
3.1、登录管理后台
使用管理员账号登录
进入Admin Center
3.2、添加Fields
3.3、添加views
3.4添加DBMappings,用于建立字段对应关系
uID => id, Date => devicereportedtime, Host => fromhost, IP => fromip, Messagetype => infounitid, Message => message, Facility => facility, Severity => priority, Syslogtag => syslogtag, ProcessID => processid, Event ID => eventid, Eventlog Type => eventlogtype, Event Source => eventsource, Event Category => eventcategory, Event User => eventuser, SystemID => systemid, Checksum => checksum
注: DBMappings注意大小写,对应后面全部小写,不能有错,对应如下。
uID => id, Date => devicereportedtime, Host => fromhost, Messagetype => infounitid, Message => message, Facility => facility, Severity => priority, Syslogtag => syslogtag, ProcessID => processid, Event ID => eventid, Eventlog Type => eventlogtype, Event Source => eventsource, Event Category => eventcategory, Event User => eventuser, SystemID => systemid, Checksum => checksum
3.5、修改数据源配置
修改默认 Table type =>> MonitorWare, 修改为 SYSLOG_IP。
修改日志选择 Select View => SYSLOG_IP。
4、效果图