[root@server vusers_home]# rpm -ql rsyslog|more ###.so结尾为模块，模块有分im为输入模块，om 为输出模块
/etc/logrotate.d/syslog
/etc/pki/rsyslog
/etc/rc.d/init.d/rsyslog
/etc/rsyslog.conf
/etc/rsyslog.d
/etc/sysconfig/rsyslog
/lib64/rsyslog
/lib64/rsyslog/imfile.so
/lib64/rsyslog/imklog.so
/lib64/rsyslog/immark.so
/lib64/rsyslog/impstats.so
/lib64/rsyslog/imptcp.so
/lib64/rsyslog/imtcp.so
/lib64/rsyslog/imudp.so
/lib64/rsyslog/imuxsock.so
/lib64/rsyslog/lmnet.so
/lib64/rsyslog/lmnetstrms.so
/lib64/rsyslog/lmnsd_ptcp.so
/lib64/rsyslog/lmregexp.so
/lib64/rsyslog/lmstrmsrv.so
/lib64/rsyslog/lmtcpclt.so
/lib64/rsyslog/lmtcpsrv.so
/lib64/rsyslog/lmzlibw.so
/lib64/rsyslog/ommail.so
/lib64/rsyslog/omprog.so
/lib64/rsyslog/omruleset.so
/lib64/rsyslog/omtesting.so
/lib64/rsyslog/omuxsock.so
/lib64/rsyslog/pmlastmsg.so
/sbin/rsyslogd
......
主程序：rsyslogd
配置文件：/etc/rsyslog.conf
服务脚本：/etc/rc.d/init.d/rsyslog
/var/log/dmesg #是用来记录系统启动日志的
rsyslog.conf(配置文件)
RULES:
facility.priority target
日志收集方：
facility：设施，从功能或程序上对日志进行分类；
auth, authpriv, cron, daemon, kern, lpr, mail, mark, news, security, user, uucp, local0-local7, syslog
priority
debug, info, notice, warn(warning), err(error), crit(critical), alert, emerg(panic)
示例：
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
指定级别：
*: 所有级别
none: 没有级别
priority: 此级别及更高级别的日志信息
=priority：此级别
target:
文件路径：记录于指定的日志文件中，通常应该在/var/log目录下；文件路径前的“-”表示异步写入；
用户：将日志通知给指定用户
*: 所有用户
日志服务器：@host
host: 必须要监听在tcp或udp协议514端口上提供服务；
管道： |COMMAND
测试实例：
ssh 服务单独记录一个日志文件：
[root@server vusers_home]# vim /etc/ssh/sshd_config
# Logging
# obsoletes QuietMode and FascistLogging
#SyslogFacility AUTH
#SyslogFacility AUTHPRIV
SyslogFacility local2 #将原有的换成local2
[root@server vusers_home]# service sshd reload
Reloading sshd: [ OK ]
[root@server vusers_home]# vim /etc/rsyslog.conf
# Save boot messages also to boot.log
local7.* /var/log/boot.log
local2.* /var/log/sshd.log
[root@server vusers_home]# service rsyslog restart
Shutting down system logger: [ OK ]
Starting system logger: [ OK ]
在另外一个端口重新登录并查看日志：
[root@server vusers_home]# cat /var/log/sshd.log
May 18 16:04:50 server sshd[5290]: reverse mapping checking getaddrinfo for bogon [192.168.244.2] failed - POSSIBLE BREAK-IN ATTEMPT!
May 18 16:04:50 server sshd[5290]: Accepted password for root from 192.168.244.2 port 62797 ssh2
[root@server vusers_home]# cat /var/log/sshd.log
May 18 16:04:50 server sshd[5290]: reverse mapping checking getaddrinfo for bogon [192.168.244.2] failed - POSSIBLE BREAK-IN ATTEMPT!
May 18 16:04:50 server sshd[5290]: Accepted password for root from 192.168.244.2 port 62797 ssh2
文件记录的日志的格式：
事件产生的日期时间 主机 进程(pid)：事件内容
例：
May 18 16:02:27 server sshd[5239]: Server listening on :: port 22.
May 18 16:03:46 server kernel: Kernel logging (proc) stopped.
有些日志记录二进制格式：/var/log/wtmp，/var/log/btmp
/var/log/wtmp: 当前系统上成功登录的日志；
last
例子：
[root@server ~]# last
root pts/1 192.168.244.2 Thu May 18 16:04 still logged in
root pts/1 192.168.244.2 Thu May 18 16:04 - 16:04 (00:00)
root pts/0 192.168.244.2 Thu May 18 10:40 - 16:37 (05:56)
root pts/0 192.168.244.2 Wed May 17 11:43 - 10:39 (22:55)
root pts/1 192.168.244.2 Mon Jun 13 19:19 - 11:24 (337+16:05)
root pts/0 192.168.244.2 Mon Jun 13 18:57 - 11:24 (337+16:27)
root pts/1 192.168.244.2 Mon Jun 13 08:55 - 18:45 (09:50)
root pts/0 192.168.244.2 Mon Jun 13 03:59 - 10:45 (06:46)
reboot system boot 2.6.32-573.el6.x Mon Jun 13 03:58 - 16:37 (339+12:39)
root pts/1 192.168.244.2 Sun Jun 12 23:58 - down (03:59)
root pts/0 192.168.244.2 Sun Jun 12 23:39 - 01:52 (02:13)
root tty1 Sun Jun 12 23:28 - down (04:29)
reboot system boot 2.6.32-573.el6.x Sun Jun 12 23:27 - 03:57 (04:30)
root tty1 Sun Jun 12 23:26 - down (00:01)
reboot system boot 2.6.32-573.el6.x Sun Jun 12 23:25 - 23:27 (00:01)
/var/log/btmp：当前系统上失败的登录尝试；
lastb
[root@server ~]# lastb
root ssh:notty 192.168.244.101 Thu May 18 16:33 - 16:33 (00:00)
lastlog命令：显示当前系统每一个用户最近一次的登录时间；
例子：
[root@server ~]# lastlog
Username Port From Latest
root pts/0 192.168.244.2 Thu May 18 16:37:34 +0800 2017
bin **Never logged in**
daemon **Never logged in**
####日志服务器如何完成（也就是如何作为收集其他机器日志信息的日志服务器）#############
环境：日志服务器：192.168.244.100
被收集服务器：192.168.244.101
#要成为rsyslog只需打开监听模块即可
[root@192.168.244.100 ~]# vim /etc/rsyslog.conf #需要监听514端口，用udp还是tcp可自选
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
# Provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514
[root@server ~]# netstat -lntup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 5407/rsyslogd
tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 2785/mysqld
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 5112/vsftpd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 5239/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1389/master
tcp 0 0 :::514 :::* LISTEN 5407/rsyslogd
tcp 0 0 :::22 :::* LISTEN 5239/sshd
tcp 0 0 ::1:25 :::* LISTEN 1389/master
udp 0 0 0.0.0.0:514 0.0.0.0:* 5407/rsyslogd
udp 0 0 :::514 :::* 5407/rsyslogd
[root@192.168.244.101 ~]# vi /etc/rsyslog.conf
#*.info;mail.none;authpriv.none;cron.none /var/log/messages
*.info;mail.none;authpriv.none;cron.none @192.168.244.100
[root@192.168.244.101 ~]# service rsyslog restart
[root@192.168.244.101 ~]# yum install -y vsftpd
在rsyslog服务器的/var/log/message上可以看到：
[root@192.168.244.100 ~]# tail -f /var/log/messages
May 18 05:19:29 localhost yum[5817]: Installed: vsftpd-3.0.2-21.el7.x86_64
注意点：如果有防火墙，需放行514端口
#####################如何让rsyslog服务器将日志记录到远端mysql数据库中#####################
环境：
mysql-server:192.168.244.101
rsyslog-server:192.168.244.100
[root@server ~]# ip addr|grep global
inet 192.168.244.100/24 brd 192.168.244.255 scope global eth0
[root@centos7 ~]# ip addr|grep inet|grep global
inet 192.168.244.101/24 brd 192.168.244.255 scope global eno16777736
[root@centos7 ~]# rpm -qa mariadb
mariadb-5.5.52-1.el7.x86_64
[root@centos7 ~]# ss -tnl|grep 3306
LISTEN 0 50 *:3306 *:*
[root@server src]# yum list all rsyslog* #查看相关包，最主要的需要rsyslog-mysql 这个程序包，连接mysql的驱动
rsyslog-mysql.x86_64 5.8.10-10.el6_6 base
[root@server ~]# yum install -y rsyslog-mysql
[root@server ~]# rpm -ql rsyslog-mysql
/lib64/rsyslog/ommysql.so #模块
/usr/share/doc/rsyslog-mysql-5.8.10
/usr/share/doc/rsyslog-mysql-5.8.10/createDB.sql #mysql命令包，需要在mysql中运行
[root@centos7 ~]# mysql #登陆mysql-server 为sysloguser 这个用户授权
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 5
Server version: 5.5.52-MariaDB MariaDB Server
Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> grant all on Syslog.* to 'sysloguser'@'192.168.%.%' identified by 'syslogpass';
[root@centos7 ~]# vim /etc/my.cnf #增加如下两行
[mysqld]
skip_name_resolve = on
innodb_file_per_table = on
[root@centos7 ~]# systemctl restart mariadb.service #重启mysql-server
[root@server ~]# mysql -usysloguser -h192.168.244.101 -p #在rsyslog服务器连接测试mysql-server中新建的用户可连接性
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.5.52-MariaDB MariaDB Server
Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>
接下来导入下面的sql 包：
[root@server ~]# mysql -usysloguser -h192.168.244.101 -p < /usr/share/doc/rsyslog-mysql-5.8.10/createDB.sql
[root@server ~]# mysql -usysloguser -h192.168.244.101 -p #登陆mysql-server 查看操作是否成功，Syslog库是否建立
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 5
Server version: 5.5.52-MariaDB MariaDB Server
Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| Syslog |
| test |
+--------------------+
3 rows in set (0.00 sec)
mysql> use Syslog;
Database changed
mysql> show tables;
+------------------------+
| Tables_in_Syslog |
+------------------------+
| SystemEvents |
| SystemEventsProperties |
+------------------------+
2 rows in set (0.00 sec)
mysql> desc SystemEvents;
+--------------------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+--------------------+------------------+------+-----+---------+----------------+
| ID | int(10) unsigned | NO | PRI | NULL | auto_increment |
| CustomerID | bigint(20) | YES | | NULL | |
| ReceivedAt | datetime | YES | | NULL | |
| DeviceReportedTime | datetime | YES | | NULL | |
| Facility | smallint(6) | YES | | NULL | |
| Priority | smallint(6) | YES | | NULL | |
| FromHost | varchar(60) | YES | | NULL | |
| Message | text | YES | | NULL | |
| NTSeverity | int(11) | YES | | NULL | |
| Importance | int(11) | YES | | NULL | |
| EventSource | varchar(60) | YES | | NULL | |
| EventUser | varchar(60) | YES | | NULL | |
| EventCategory | int(11) | YES | | NULL | |
| EventID | int(11) | YES | | NULL | |
| EventBinaryData | text | YES | | NULL | |
| MaxAvailable | int(11) | YES | | NULL | |
| CurrUsage | int(11) | YES | | NULL | |
| MinUsage | int(11) | YES | | NULL | |
| MaxUsage | int(11) | YES | | NULL | |
| InfoUnitID | int(11) | YES | | NULL | |
| SysLogTag | varchar(60) | YES | | NULL | |
| EventLogType | varchar(60) | YES | | NULL | |
| GenericFileName | varchar(60) | YES | | NULL | |
| SystemID | int(11) | YES | | NULL | |
+--------------------+------------------+------+-----+---------+----------------+
24 rows in set (0.00 sec)
mysql> desc SystemEventsProperties;
+---------------+------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+---------------+------------------+------+-----+---------+----------------+
| ID | int(10) unsigned | NO | PRI | NULL | auto_increment |
| SystemEventID | int(11) | YES | | NULL | |
| ParamName | varchar(255) | YES | | NULL | |
| ParamValue | text | YES | | NULL | |
+---------------+------------------+------+-----+---------+----------------+
4 rows in set (0.01 sec)
mysql>
##################接下里配置rsyslog服务器能使用mysql###################
[root@server ~]# vim /etc/rsyslog.conf #编辑文件，在MODULES 里，增加一行
#### MODULES ####
$ModLoad ommysql
#### RULES ####
#*.info;mail.none;authpriv.none;cron.none /var/log/messages
*.info;mail.none;authpriv.none;cron.none :ommysql:192.168.244.101,Syslog,sysloguser,syslogpass
注释：:ommysql:192.168.244.101,Syslog,sysloguser,syslogpass
输出到mysql模块：mysql地址，数据库名，数据库登陆名，数据库登陆密码
[root@server ~]# /etc/init.d/rsyslog restart #重启rsyslog
[root@server ~]# yum install -y zile
[root@centos7 ~]# mysql #mysql-server #查看安装zile是否有记录
MariaDB [Syslog]> select count(*) from SystemEvents;
+----------+
| count(*) |
+----------+
| 4 |
+----------+
1 row in set (0.01 sec)
MariaDB [Syslog]> select count(*) from SystemEventsProperties;
+----------+
| count(*) |
+----------+
| 0 |
+----------+
1 row in set (0.00 sec)
MariaDB [Syslog]> select * from SystemEvents\G;
*************************** 1. row ***************************
ID: 1
CustomerID: NULL
ReceivedAt: 2017-05-18 18:25:57
DeviceReportedTime: 2017-05-18 18:25:57
Facility: 0
Priority: 6
FromHost: server
Message: imklog 5.8.10, log source = /proc/kmsg started.
NTSeverity: NULL
Importance: NULL
EventSource: NULL
EventUser: NULL
EventCategory: NULL
EventID: NULL
EventBinaryData: NULL
MaxAvailable: NULL
CurrUsage: NULL
MinUsage: NULL
MaxUsage: NULL
InfoUnitID: 1
SysLogTag: kernel:
EventLogType: NULL
GenericFileName: NULL
SystemID: NULL
*************************** 2. row ***************************
ID: 2
CustomerID: NULL
ReceivedAt: 2017-05-18 18:25:57
DeviceReportedTime: 2017-05-18 18:25:57
Facility: 5
Priority: 6
FromHost: server
Message: [origin software="rsyslogd" swVersion="5.8.10" x-pid="5626" x-info="http://www.rsyslog.com"] start
NTSeverity: NULL
Importance: NULL
EventSource: NULL
EventUser: NULL
EventCategory: NULL
EventID: NULL
EventBinaryData: NULL
MaxAvailable: NULL
CurrUsage: NULL
MinUsage: NULL
MaxUsage: NULL
InfoUnitID: 1
SysLogTag: rsyslogd:
EventLogType: NULL
GenericFileName: NULL
SystemID: NULL
*************************** 3. row ***************************
ID: 3
CustomerID: NULL
ReceivedAt: 2017-05-18 18:28:51
DeviceReportedTime: 2017-05-18 18:28:51
Facility: 1
Priority: 6
FromHost: server
Message: Installed: gc-7.1-12.el6_4.x86_64
NTSeverity: NULL
Importance: NULL
EventSource: NULL
EventUser: NULL
EventCategory: NULL
EventID: NULL
EventBinaryData: NULL
MaxAvailable: NULL
CurrUsage: NULL
MinUsage: NULL
MaxUsage: NULL
InfoUnitID: 1
SysLogTag: yum[5666]:
EventLogType: NULL
GenericFileName: NULL
SystemID: NULL
*************************** 4. row ***************************
ID: 4
CustomerID: NULL
ReceivedAt: 2017-05-18 18:28:51
DeviceReportedTime: 2017-05-18 18:28:51
Facility: 1
Priority: 6
FromHost: server
Message: Installed: zile-2.4.9-1.el6.x86_64
NTSeverity: NULL
Importance: NULL
EventSource: NULL
EventUser: NULL
EventCategory: NULL
EventID: NULL
EventBinaryData: NULL
MaxAvailable: NULL
CurrUsage: NULL
MinUsage: NULL
MaxUsage: NULL
InfoUnitID: 1
SysLogTag: yum[5666]:
EventLogType: NULL
GenericFileName: NULL
SystemID: NULL
4 rows in set (0.00 sec)
###################安装loganalyzer##################
[root@server ~]# yum install -y httpd php php-mysql php-gd(后面数据统计，出图形需要用到)
[root@server ~]# netstat -ant
tcp 0 0 :::80 :::* LISTEN
测试下php,与mysql的连通性：
[root@server ~]# cd /var/www/html/
You have new mail in /var/spool/mail/root
[root@server html]# ll
total 8
-rw-r--r-- 1 root root 329 May 18 18:45 index.php
-rw-r--r-- 1 root root 20 May 18 18:42 phpinfo.php
[root@server html]# cat phpinfo.php
<?php
phpinfo();
?>
[root@server html]# cat index.php
<?php
$conn = mysql_connect('192.168.244.101','sysloguser','syslogpass');
if ($conn)
echo "OK";
else
echo "Failure";
mysql_close();
?>
[root@server ~]# curl 192.168.244.100/index.php #可以连接上数据库
OK
[root@server ~]# curl -I 192.168.244.100/phpinfo.php #访问php页面OK
HTTP/1.1 200 OK
################安装LogAnalyzer#################
[root@server ~]# cd /usr/local/src/
[root@server src]# wget http://download.adiscon.com/loganalyzer/loganalyzer-3.6.5.tar.gz
[root@server src]# mv loganalyzer-3.6.5 /var/www/html/loganalyzer
[root@server src]# cd /var/www/html/loganalyzer/
[root@server ~]# cd /var/www/html/loganalyzer/contrib/
[root@server contrib]# cat configure.sh
#!/bin/sh
touch config.php
chmod 666 config.php
[root@server contrib]# chmod +x *.sh
[root@server contrib]# ./configure.sh #让其生成config.php 文件
[root@server src]# chmod 666 config.php
[root@server src]# pwd
/var/www/html/loganalyzer/src
[root@server src]# ll config.php
-rw-rw-rw- 1 root root 0 May 19 15:02 config.php
然后去浏览器操作：
完成！！！！！！！！！！！！！！！！！！
大致总结下过程：
配置使用基于mysql存储日志信息：
(1) 准备好MySQL服务器，创建用户，授权对Syslog数据库的全部访问权限；
(2) 安装rsyslog-mysql程序包；
(3) 创建rsyslog-mysql依赖的数据库；
# mysql -uUSERNAME -hHOST -pPASSWORD < /usr/share/doc/rsyslog-mysql-VERSION/createDB.sql
(4) 配置rsyslog使用ommysql模块
#### MODULES ####
$ModLoad ommysql
#### RULES ####
facility.priority :ommysql:DBHOST,DB,DBUSER,USERPASS
重启rsyslog服务
(5) 安装loganalyzer
(a) 配置webserver, 支持php
# yum install httpd php php-mysql php-gd
# service httpd start
(b) loganalyzer
# cp -r loganalyzer-3.6.5/src /var/www/html/loganalyzer
# cp loganalyzer-3.6.5/contrib/*.sh /var/www/html/loganalyzer
# cd /var/www/html/loganalyzer
# chmod +x *.sh
# ./configure.sh
# ./secure.sh
# chmod 666 config.php
