Linux-loganalyzer展示日志
实验设备
centos7 10.0.0.17 安装数据库 数据库服务器 （本环境 数据库 yum安装 mariadb）
centos7 10.0.0.27 rsyslog 日志服务器
centos7 10.0.0.37 LAP httpd+php服务器
1、centos7 10.0.0.27 rsyslog服务器
[root@rsyslog ~]#yum install rsyslog-mysql 安装日志数据库存储服务 [root@rsyslog ~]#cat /usr/share/doc/rsyslog-8.24.0/mysql-createDB.sql 数据库内容 CREATE DATABASE Syslog; USE Syslog; CREATE TABLE SystemEvents ( ID int unsigned not null auto_increment primary key, CustomerID bigint, ReceivedAt datetime NULL, DeviceReportedTime datetime NULL, Facility smallint NULL, Priority smallint NULL, FromHost varchar(60) NULL, Message text, NTSeverity int NULL, Importance int NULL, EventSource varchar(60), EventUser varchar(60) NULL, EventCategory int NULL, EventID int NULL, EventBinaryData text NULL, MaxAvailable int NULL, CurrUsage int NULL, MinUsage int NULL, MaxUsage int NULL, InfoUnitID int NULL , SysLogTag varchar(60), EventLogType varchar(60), GenericFileName VarChar(60), SystemID int NULL ); CREATE TABLE SystemEventsProperties ( ID int unsigned not null auto_increment primary key, SystemEventID int NULL , ParamName varchar(255) NULL , ParamValue text NULL ); [root@rsyslog ~]#scp /usr/share/doc/rsyslog-8.24.0/mysql-createDB.sql 10.0.0.17:/data 拷贝到数据库服务器还原
2、centos7 10.0.0.17 mysql服务器
登录数据库：加载数据库，创建远程用户并授权
mysql> source /data/mysql-createDB.sql 加载数据库 Query OK, 1 row affected (0.00 sec) Database changed Query OK, 0 rows affected (0.02 sec) Query OK, 0 rows affected (0.00 sec) mysql> show databases; +--------------------+ | Database | +--------------------+ | Syslog | | information_schema | | mysql | | performance_schema | | sys | +--------------------+ 5 rows in set (0.00 sec) mysql> use Syslog; Database changed mysql> show tables; +------------------------+ | Tables_in_Syslog | +------------------------+ | SystemEvents | | SystemEventsProperties | +------------------------+ 2 rows in set (0.00 sec) mysql> create user syslogin@'10.0.0.%' identified by '123456'; 创建用户 Query OK, 0 rows affected (0.01 sec) mysql> grant all on Syslog.* to syslogin@'10.0.0.%'; 授权可以操作Syslog数据库的任何表 Query OK, 0 rows affected (0.01 sec)
3、centos7 10.0.0.27 rsyslog服务器
编辑配置文件
[root@rsyslog ~]#vim /etc/rsyslog.conf # Provides TCP syslog reception ##$ModLoad imtcp ##$InputTCPServerRun 514 $ModLoad ommysql 连接数据库存储组件 # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages *.info;mail.none;authpriv.none;cron.none :ommysql:10.0.0.17,Syslog,syslogin,123456 数据库连接
4、centos7 10.0.0.17 MySQL服务器
查看日志服务器连接数据库是否正常
MariaDB [Syslog]> select * from SystemEvents \G;
*************************** 1613. row *************************** ID: 1613 CustomerID: NULL ReceivedAt: 2022-05-27 19:08:43 DeviceReportedTime: 2022-05-27 19:08:43 Facility: 5 Priority: 4 FromHost: rsyslog Message: action 'action 2' suspended, next retry is Fri May 27 19:09:13 2022 [v8.24.0-57.el7_9.2 try http://www.rsyslog.com/e/2007 ] NTSeverity: NULL Importance: NULL EventSource: NULL EventUser: NULL EventCategory: NULL EventID: NULL EventBinaryData: NULL MaxAvailable: NULL CurrUsage: NULL MinUsage: NULL MaxUsage: NULL InfoUnitID: 1 SysLogTag: rsyslogd: EventLogType: NULL GenericFileName: NULL SystemID: NULL
5、centos7 10.0.0.37 安装 LAP （yum安装）
[root@lap ~]#yum -y install httpd php-fpm php-mysqlnd php-gd
编辑php访问测试文件
[root@lap ~]#vim /var/www/html/index.php <?php phpinfo(); ?> 启动服务 [root@lap ~]#systemctl enable --now httpd php-fpm
php测试访问正常
6、centos7 10.0.0.47 LAP 服务器
[root@lap ~]#wget https://download.adiscon.com/loganalyzer/loganalyzer-4.1.12.tar.gz 下载loganalyzer
[root@lap ~]#tar xf loganalyzer-4.1.12.tar.gz 解压文件
[root@lap ~]#ll
total 1180968
-rw-------. 1 root root 1580 Apr 18 18:20 anaconda-ks.cfg
drwxrwxr-x 5 root root 90 Apr 29 2021 loganalyzer-4.1.12
-rw-r--r-- 1 root root 5028816 Apr 29 2021 loganalyzer-4.1.12.tar.gz
-rw-r--r-- 1 root root 1204277208 Dec 18 15:29 mysql-8.0.28-linux-glibc2.12-x86_64.tar.xz
[root@lap ~]#mv loganalyzer-4.1.12/src/ /var/www/html/log #移动src目录，到/var/www/html/log/目录下。src中都是php文件
[root@lap ~]#touch /var/www/html/log/config.php #建立config.php文件，页面配置需要用到
[root@lap ~]#chmod 666 /var/www/html/log/config.php #修改权限为读写
[root@lap ~]#ll /var/www/html/log/config.php
-rw-rw-rw- 1 root root 0 May 27 18:58 /var/www/html/log/config.php
7、浏览器页面配置loganalyzer视图界面
访问10.0.0.47/log
点击here
下一步
此处config.php文件提前建好的，参照第6步
下一步
默认下一步
选择MySQL Native
数据库服务器地址
数据库名称
日志对应表
账号
密码
下一步
完成
界面
测试日志
[root@rsyslog ~]#logger "this is a test log"
图形
