centos8 安装配置rsyslog + LogAnalyzer + mysql

centos8 安装配置rsyslog + LogAnalyzer + mysql

模拟三台主机
一台rsyslog日志服务器，IP：10.0.0.168
一台mysql数据库服务器，IP：10.0.0.178
一台当httpd+php 服务器，并安装loganalyzer展示web图形，IP：10.0.0.188

1、在rsyslog服务器上安装连接mysql模块相关的程序包

[root@centos8mn ~]#yum install rsyslog-mysql -y

[root@centos8mn ~]#systemctl enable --now rsyslog.service

#查看sql脚本文件内容
[root@centos8mn ~]#cat /usr/share/doc/rsyslog/mysql-createDB.sql
CREATE DATABASE Syslog;
USE Syslog;
CREATE TABLE SystemEvents
(
        ID int unsigned not null auto_increment primary key,
        CustomerID bigint,
        ReceivedAt datetime NULL,
        DeviceReportedTime datetime NULL,
        Facility smallint NULL,
        Priority smallint NULL,
        FromHost varchar(60) NULL,
        Message text,
        NTSeverity int NULL,
        Importance int NULL,
        EventSource varchar(60),
        EventUser varchar(60) NULL,
        EventCategory int NULL,
        EventID int NULL,
        EventBinaryData text NULL,
        MaxAvailable int NULL,
        CurrUsage int NULL,
        MinUsage int NULL,
        MaxUsage int NULL,
        InfoUnitID int NULL ,
        SysLogTag varchar(60),
        EventLogType varchar(60),
        GenericFileName VarChar(60),
        SystemID int NULL
);

CREATE TABLE SystemEventsProperties
(
        ID int unsigned not null auto_increment primary key,
        SystemEventID int NULL ,
        ParamName varchar(255) NULL ,
        ParamValue text NULL
);

[root@centos8mn ~]#scp /usr/share/doc/rsyslog/mysql-createDB.sql 10.0.0.178:/data

2、准备MySQL Server

[root@centos8mn ~]#yum -y install mariadb-server

[root@centos8mn ~]#systemctl enable --now mariadb

[root@centos8mn ~]#mysql

MariaDB [(none)]> source /data/mysql-createDB.sql
Query OK, 1 row affected (0.000 sec)

Database changed
Query OK, 0 rows affected (0.003 sec)

Query OK, 0 rows affected (0.005 sec)

MariaDB [Syslog]> GRANT ALL ON Syslog.* TO 'rsyslog'@'10.0.0.%' IDENTIFIED BY '123456';
Query OK, 0 rows affected (0.000 sec)

3、配置日志服务器将日志发送至指定数据库

[root@centos8mn ~]#vim /etc/rsyslog.conf
#
####MODULES####
#在 MODULES 语言下面，如果是 CentOS 8 加下面行
module(load="ommysql")

#在 MODULES 语言下面，如果是 CentOS 7，6 加下面行
$ModLoad ommysql

#在RULES语句块加下面行的格式
#facility.priority :ommysql:DBHOST,DBNAME,DBUSER, PASSWORD
*.info                                  :ommysql:10.0.0.178,Syslog,rsyslog,123456

[root@centos8mn ~]#systemctl restart rsyslog.service

4、测试

#在日志服务器上生成日志
[root@centos8mn ~]#logger "this is a test log"
#在数据库上查询到上面的测试日志
mysql>SELECT COUNT(*) FROM SystemEvents

5、通过 loganalyzer 展示数据库中的日志

在10.0.0.188主机上安装httpd, php和相关软件包

[root@centos8mn ~]#yum -y install httpd php-fpm php-mysqlnd php-gd
[root@centos8mn~]#systemctl enable --now httpd php-fpm

#从http://loganalyzer.adiscon.com/downloads/ 下载loganalyzer-4.1.12.tar.gz

[root@centos8mn ~]#tar xvf loganalyzer-4.1.12.tar.gz
[root@centos8mn ~]#mv loganalyzer-4.1.12/src/ /var/www/html/log
[root@centos8mn ~]#touch /var/www/html/log/config.php
[root@centos8mn ~]#chmod 666 /var/www/html/log/config.php

6、基于 web 页面初始化

访问http://10.0.0.188/log 实现初始化