syslog-ng (日志集中管理)

来源：互联网发布：编程公司编辑：程序博客网时间：2024/06/02 16:05

1、syslog-ng   日志服务器，可以从网络接收日志，并且把日志写文本或者数据库中
2、LAMP    用于发布php页面，并且使用mysql来存储从客户端发过来的日志
3、php-syslog-ng  日志查询前端，使用php编写的页面
4、syslog-ng-client  日志收集客户端，用于在客户把日志收集并且通过网络方式发送给日志服务器

日志服务器的逻辑：
syslog-ng-client-->syslog-ng-server-->mysqld-->php-syslog-ng(php查询页面)

client端逻辑：
source s_local {kernel/programe}-->destination(d_messages)/destination(d_logserver)

server端的逻辑：
local/remote-->syslog-ng-server-->destination(d_mysql)
       1、/var/log/mysql.pipe(管道文件)
       2、template
       3、while.sh-->mysqld
       4、IE/firefox-->httpd-->php(select.php)-->mysqld.syslog.logs

2）日志服务器
# vim /opt/syslog-ng/etc/syslog-ng.conf
@version: 3.0
options {
};
source s_local {
        internal();
        unix-stream("/dev/log");
        file("/proc/kmsg" program_override("kernel"));
};
destination d_mysql {
   pipe("/var/log/mysql.pipe"
      template("INSERT INTO logs
      (host, facility, priority, level, tag, datetime, program, msg)
      VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n") template-escape(yes));
};
log {
        source(s_local);
        destination(d_mysql);
};

vim /opt/syslog-ng/syslog2mysql.sh －－读取日志存放至mysql服务器
#!/bin/bash

if [ ! -e /var/log/mysql.pipe ]
then
mkfifo /var/log/mysql.pipe
fi
while [ -e /var/log/mysql.pipe ]
do
mysql -u root --password=123 syslog < /var/log/mysql.pipe >/dev/null
done

# chmod +x /opt/syslog-ng/syslog2mysql.sh
# nohup /opt/syslog-ng/syslog2mysql.sh &

# vim /opt/syslog-ng/etc/syslog-ng.conf
@version: 3.0
options {
};
source s_local {
        internal();
        unix-stream("/dev/log");
        file("/proc/kmsg" program_override("kernel"));
        udp(
                ip(0.0.0.0)
                port(514)
        );
        tcp(
                ip(0.0.0.0)
                port(514)
        );
};
destination d_mysql {
   pipe("/var/log/mysql.pipe"
      template("INSERT INTO logs
      (host, facility, priority, level, tag, datetime, program, msg)
      VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n") template-escape(yes));
};
log {
        source(s_local);
        destination(d_mysql);
};

# /etc/init.d/syslog-ng restart
# netstat -tunlp |grep :514
tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 18204/syslog-ng
udp 0 0 0.0.0.0:514 0.0.0.0:* 18204/syslog-ng

# vim /etc/httpd/conf/httpd.conf
<Directory "/var/www/phpsyslogng/scripts">
    Deny from all
</Directory>
<Directory "/var/www/phpsyslogng/includes">
    Deny from all
</Directory>
<Directory "/var/www/phpsyslogng/config">
    Deny from all
</Directory>

# service httpd restart

syslog-client

# vim /opt/syslog-ng/etc/syslog-ng.conf
@version: 3.0

options {
};
source s_local {
        internal();
        unix-stream("/dev/log");
        file("/proc/kmsg" program_override("kernel"));
};

destination d_messages { file("/var/log/messages"); };
destination d_logserver { udp("192.168.0.1");};

log {
        source(s_local);
        destination(d_messages);
        destination(d_logserver);
};

# service syslog-ng restart

1)编辑滚动脚本，告诉这个脚本php-syslog-ng安装在系统中哪个目录
# vim /var/www/html/scripts/logrotate.php
$APP_ROOT = '/var/www/html';

# /usr/bin/php /var/www/html/scripts/logrotate.php －－执行日志滚动

Starting logrotate
2012-09-05 10:05:26
Log rotate ended successfully.
Now optimizing the old logs.
Getting list of log tables.
Searching for tables to drop.
Creating merge table.

2012-09-05 10:05:26
All done!

2）修改当前的日期，再次滚动
# date -s 2012-09-06

# /usr/bin/php /var/www/html/scripts/logrotate.php

Starting logrotate
2012-09-06 00:00:21
Log rotate ended successfully.
Now optimizing the old logs.
Getting list of log tables.
Searching for tables to drop.
Creating merge table.

2012-09-06 00:00:21
All done!

3）配置保留30个最新日志记录
# vim /var/www/html/config/config.php
7 define('LOGROTATERETENTION', 30);

打补丁：
# wget ftp://192.168.0.254/notes/softwares/project/syslog-ng/logrotate.patch -P /root
# cd /var/www/html/scripts
# patch -p1 ./logrotate.php < /root/logrotate.patch
missing header for unified diff at line 3 of patch
patching file ./logrotate.php
Hunk #1 succeeded at 70 with fuzz 2.

4)配置自动滚动(每3天)
# crontab -e
00 05 */3 * * /usr/bin/php /var/www/html/scripts/logrotate.php &> /dev/null

0 0