在服务器中打开mysql数据库文件,rsyslog记录于MySQL数据库中

rsyslog记录于MySQL数据库中

准备数据库服务器1台，用来发送日志的主机一台

主机

ip

rsyslog

192.168.73.110

MySQL

192.168.73.111

rsyslog服务器操作

1.安装rsyslog用来连接MySQL服务器的相关的程序包

[root@rsyslog ~]# yum install -y rsyslog-mysql

2.查看rsyslog-mysql所安装的相关内容

[root@rsyslog ~]# rpm -ql rsyslog-mysql

/usr/lib64/rsyslog/ommysql.so #rsyslog-mysql模块

/usr/share/doc/rsyslog-8.24.0/mysql-createDB.sql #数据库的表

3.修改rsyslog的配置文件，加载rsyslog-msyql模块，定义规则

#### MODULES ####

$ModLoad ommysql

#### RULES ####

*.info;mail.none;authpriv.none;cron.none :ommysql:192.168.73.111,Syslog,user,111111

4.将rsyslog数据库表传送至MySQL服务器

[root@rsyslog ~]# scp /usr/share/doc/rsyslog-8.24.0/mysql-createDB.sql 192.168.73.111:/root

MySQL服务器操作

1.安装MySQL,启动服务

[root@mysql ~]# yum install mariadb-server -y

[root@mysql ~]# systemctl start mariadb

2.在MySQL上授权rsyslog可以连接至当前服务器

[root@mysql ~]# mysql -e "GRANT ALL ON Syslog.* TO 'loguser'@'192.168.73.110' IDENTIFIED BY '111111';"

3.导入rsyslog库

[root@mysql ~]# mysql < mysql-createDB.sql

测试

1.在syslog服务器上发送测试信息

[root@rsyslog ~]# logger "test log"

2.在数据库中查询

MariaDB [(none)]> select * from Syslog.SystemEvents\G;

*************************** 1. row ***************************

ID: 1

CustomerID: NULL

ReceivedAt: 2019-05-17 18:05:41

DeviceReportedTime: 2019-05-17 18:05:41

Facility: 1

Priority: 5

FromHost: rsyslog

Message: test log #发送的测试信息

NTSeverity: NULL

Importance: NULL

EventSource: NULL

EventUser: NULL

EventCategory: NULL

EventID: NULL

EventBinaryData: NULL

MaxAvailable: NULL

CurrUsage: NULL

MinUsage: NULL

MaxUsage: NULL

InfoUnitID: 1

SysLogTag: root:

EventLogType: NULL

GenericFileName: NULL

SystemID: NULL

*************************** 2. row ***************************

ID: 2

CustomerID: NULL

ReceivedAt: 2019-05-17 18:05:41

DeviceReportedTime: 2019-05-17 18:05:41

Facility: 5

Priority: 6

FromHost: rsyslog

Message: action 'action 1' resumed (module 'ommysql') [v8.24.0-34.el7 try http://www.rsyslog.com/e/2359 ]

NTSeverity: NULL

Importance: NULL

EventSource: NULL

EventUser: NULL

EventCategory: NULL

EventID: NULL

EventBinaryData: NULL

MaxAvailable: NULL

CurrUsage: NULL

MinUsage: NULL

MaxUsage: NULL

InfoUnitID: 1

SysLogTag: rsyslogd:

EventLogType: NULL

GenericFileName: NULL

SystemID: NULL

*************************** 3. row ***************************

ID: 3

CustomerID: NULL

ReceivedAt: 2019-05-17 18:05:41

DeviceReportedTime: 2019-05-17 18:05:41

Facility: 5

Priority: 6

FromHost: rsyslog

Message: action 'action 1' resumed (module 'ommysql') [v8.24.0-34.el7 try http://www.rsyslog.com/e/2359 ]

NTSeverity: NULL

Importance: NULL

EventSource: NULL

EventUser: NULL

EventCategory: NULL

EventID: NULL

EventBinaryData: NULL

MaxAvailable: NULL

CurrUsage: NULL

MinUsage: NULL

MaxUsage: NULL

InfoUnitID: 1

SysLogTag: rsyslogd:

EventLogType: NULL

GenericFileName: NULL

SystemID: NULL

3 rows in set (0.00 sec)

ERROR: No query specified

将数据库中的日志通过loganalyzer展示

准备httpd+php服务器一台

主机

ip

http

192.168.73.112

搭建lamp

安装httpd、php、php-msyql、php-gd

[root@localhost ~]# yum install httpd php php-mysql php-gd -y

1.修改httpd配置文件

[root@localhost ~]# vim /etc/httpd/conf/httpd.conf

DirectoryIndex index.php index.html

addtype application/x-httpd-php .php

addtype application/x-httpd-php-source .phps

servername www.mylinuxops.com

documentroot /data/test

require all granted

2.创建站点目录创建测试页

[root@localhost ~]# mkdir /data/test

[root@localhost ~]# vim /data/test/index.php

$dsn='mysql:host=192.168.73.111;dbname=test';

$username='loguser'; $passwd='111111';

$dbh=new PDO($dsn,$username,$passwd);

var_dump($dbh);

phpinfo();

?>

3.启动服务测试

[root@localhost ~]# systemctl restart httpd php-fpm

4.测试

安装loganalyzer

1.解压应用

[root@localhost ~]# tar -xf loganalyzer-4.1.7.tar.gz -C /data/test/

[root@localhost ~]# cd /data/test/

2.将解压包内的src取出改名

[root@localhost test]# mv loganalyzer-4.1.7/src/ logs

3.安装

此处需要创建一个config.php的配置文件

[root@localhost test]# cd logs

[root@localhost logs]# touch config.php

[root@localhost logs]# chmod 666 config.php

4.安装完毕后把config.php配置文件权限修改

[root@localhost logs]# chmod 644 config.php

其他

如果连接MySQL的用户密码发生改变可以在config.php文件中进行修改，如果忘记密码可以将config.php删除然后重新配置。