syslog-ng详细安装配置

379次阅读

共计 18568 个字符，预计需要花费 47 分钟才能阅读完成。

最近的一个 sendcloud 项目中需要使用到 syslog-ng 收集日志。原理是多台生产机部署不同的模块，包括 nodeJs、java 等等，各个生产机根据一定的规则产生日志。一般我们的生产机 RedHat 默认采用 syslogd 记录日志，可以使用 syslogd 将日志通过网络发送到指定的日志收集机器，统一分析。

CentOS 5.8 搭建日志管理服务器（Syslog-ng+logzilla）http://www.linuxidc.com/Linux/2012-06/62198.htm

关于 Linux 中 Syslog-ng 如何在转发时修改其 facility 以及 level http://www.linuxidc.com/Linux/2012-02/53941.htm

RHEL5 下使用 Syslog-ng 构建集中型日志服务器 http://www.linuxidc.com/Linux/2010-03/25170.htm

这台日志收集机器安装的就是 syslog-ng，下面讲解一下 syslog-ng 的安装和配置步骤：

[root@server2 ~]# cd /usr/local/src/tarbag/
[root@server2 tarbag]# wget http://www.balabit.com/downloads/files?path=/eventlog/0.2/eventlog_0.2.12.tar.gz
[root@server2 tarbag]# tar -zxvf eventlog_0.2.12.tar.gz -C ../software/
[root@server2 tarbag]# cd ../software/eventlog-0.2.12/
[root@server2 eventlog-0.2.9]# ./configure –prefix=/usr/local/eventlog && make && make install
[root@server2 eventlog-0.2.9]# ls /usr/local/eventlog/
include lib

[root@server2 syslog-ng-3.0.5]# cd –
/usr/local/src/tarbag
[root@server2 tarbag]# wget http://www.balabit.com/downloads/files?path=/libol/0.3/libol-0.3.15.tar.gz
[root@server2 tarbag]# tar -zxvf libol-0.3.15.tar.gz -C ../software/
[root@server2 tarbag]# cd ../software/libol-0.3.15/
[root@server2 libol-0.3.9]# ./configure –prefix=/usr/local/libol && make && make install
[root@server2 libol-0.3.9]# ls /usr/local/libol/
bin include lib
[root@server2 libol-0.3.9]# cd –
[root@server2 tarbag]# wget http://www.balabit.com/downloads/files?path=/syslog-ng/open-source-edition/3.3.5/source/syslog-ng_3.3.5.tar.gz
[root@server2 tarbag]# tar -zxvf syslog-ng_3.3.5.tar.gz -C ../software/
[root@server2 tarbag]# cd ../software/syslog-ng-3.3.5/
[root@server2 syslog-ng-3.0.5]# export PKG_CONFIG_PATH=/usr/local/eventlog/lib/pkgconfig
[root@server2 syslog-ng-3.0.5]# ./configure –prefix=/usr/local/syslog-ng –with-libol=/usr/local/libol && make && make install
configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? (若出现这个错误，基本上是由于前面的 PKG_CONFIG_PATH 变量没指定好)
[root@server2 syslog-ng-3.0.5]# ls /usr/local/syslog-ng/
bin libexec sbin share
[root@server2 syslog-ng-3.0.5]# mkdir /usr/local/syslog-ng/etc
[root@server2 syslog-ng-3.0.5]# mkdir /usr/local/syslog-ng/var
[root@server2 syslog-ng-3.0.5]# cp contrib/syslog-ng.conf.RedHat /usr/local/syslog-ng/etc/
[root@server2 syslog-ng-3.0.5]# cp modules.conf scl.conf /usr/local/syslog-ng/etc/
[root@server2 syslog-ng-3.0.5]# cp contrib/init.d.RedHat /etc/init.d/syslog-ng

[root@server2 syslog-ng-3.0.5]# cd /usr/local/syslog-ng/etc/
[root@server2 etc]# mv syslog-ng.conf.RedHat syslog-ng.conf
[root@server2 etc]# cat syslog-ng.conf
@version:3.0
options {
long_hostnames(off);
log_msg_size(8192);
flush_lines(1);
log_fifo_size(20480);
time_reopen(10);
use_dns(yes);
dns_cache(yes);
use_fqdn(yes);
keep_hostname(yes);
chain_hostnames(no);
perm(0644);
stats_freq(43200);
};
source s_internal {internal(); };
destination d_syslognglog {file(“/var/log/syslog-ng.log”); };
log {source(s_internal); destination(d_syslognglog); };

source s_local {
unix-dgram(“/dev/log”);
file(“/proc/kmsg” program_override(“kernel:”));
};

filter f_messages {level(info..emerg); }; // 定义 7 种日志类型
filter f_secure {facility(authpriv); };
filter f_mail {facility(mail); };
filter f_cron {facility(cron); };
filter f_emerg {level(emerg); };
filter f_spooler {level(crit..emerg) and facility(uucp, news); };
filter f_local7 {facility(local7); };
destination d_messages {file(“/var/log/messages”); }; // 定义 7 种类型日志在客户端的位置
destination d_secure {file(“/var/log/secure”); };
destination d_maillog {file(“/var/log/maillog”); };
destination d_cron {file(“/var/log/cron”); };
destination d_console {usertty(“root”); };
destination d_spooler {file(“/var/log/spooler”); };
destination d_bootlog {file(“/var/log/dmesg”); };
log {source(s_local); filter(f_emerg); destination(d_console); };
log {source(s_local); filter(f_secure); destination(d_secure); flags(final); };
log {source(s_local); filter(f_mail); destination(d_maillog); flags(final); };
log {source(s_local); filter(f_cron); destination(d_cron); flags(final); };
log {source(s_local); filter(f_spooler); destination(d_spooler); };
log {source(s_local); filter(f_local7); destination(d_bootlog); };
log {source(s_local); filter(f_messages); destination(d_messages); };

# Remote logging // 定义监听的端口
source s_remote {
tcp(ip(0.0.0.0) port(514));
udp(ip(0.0.0.0) port(514));
};
// 定义客户端日志在服务器上保存的格式，位置和权限等
destination r_console {file(“/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/console” owner(“root”) group(“root”) perm(0640) dir_perm(0750) create_dirs(yes));};
destination r_secure {file(“/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/secure” owner(“root”) group(“root”) perm(0640) dir_perm(0750) create_dirs(yes));};
destination r_cron {file(“/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/cron” owner(“root”) group(“root”) perm(0640) dir_perm(0750) create_dirs(yes));};
destination r_spooler {file(“/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/spooler” owner(“root”) group(“root”) perm(0640) dir_perm(0750) create_dirs(yes));};
destination r_bootlog {file(“/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/bootlog” owner(“root”) group(“root”) perm(0640) dir_perm(0750) create_dirs(yes));};
destination r_messages {file(“/var/log/syslog-ng/$YEAR$MONTH$DAY/$HOST/messages” owner(“root”) group(“root”) perm(0640) dir_perm(0750) create_dirs(yes));};
log {source(s_remote); filter(f_emerg); destination(r_console); };
log {source(s_remote); filter(f_secure); destination(r_secure); flags(final); };
log {source(s_remote); filter(f_cron); destination(r_cron); flags(final); };
log {source(s_remote); filter(f_spooler); destination(r_spooler); };
log {source(s_remote); filter(f_local7); destination(r_bootlog); };
log {source(s_remote); filter(f_messages); destination(r_messages); };

[root@server2 etc]# chmod +x /etc/init.d/syslog-ng
[root@server2 etc]# chkconfig –add syslog-ng
service syslog-ng does not support chkconfig(若出现该错误，请修改该脚本前四行如下)
[root@server2 etc]# head -4 /etc/init.d/syslog-ng
#!/bin/bash
#chkconifg: –add syslog-ng
#chkconfig: 2345 12 88
#Description: syslog-ng

该脚本还需要修改下面的三个位置
[root@server2 etc]# grep‘PATH‘/etc/init.d/syslog-ng
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/syslog-ng/bin:/usr/local/syslog-ng/sbin
[root@server2 etc]# grep ‘INIT’ /etc/init.d/syslog-ng |head -2

INIT_PROG=”/usr/local/syslog-ng/sbin/syslog-ng” # Full path to daemon
INIT_OPTS=”-f /usr/local/syslog-ng/etc/syslog-ng.conf” # options passed to daemon

[root@server2 etc]# service syslog-ng start
Starting syslog-ng: /usr/local/syslog-ng/sbin/syslog-ng: error while loading shared libraries: libevtlog.so.0: cannot open shared object file: No such file or directory
Starting Kernel Logger: 出现此错误是因为共享库链接没做好
[root@server2 etc]#
ln -s /usr/local/eventlog/lib/* /lib/
ln -s /usr/local/eventlog/lib/* /lib64/

出现下面的问题是因为主配置文件中缺少：@version:3.0 这行
Starting syslog-ng: Configuration file has no version number, assuming syslog-ng 2.1 format. Please add @version: maj.min to the beginning of the file;

[root@server2 ~]# service syslog-ng start
Starting Kernel Logger: [OK]
[root@server2 etc]# cat /var/log/syslog-ng.log
Jan 28 03:59:07 server2.yang.com syslog-ng[20225]: syslog-ng starting up; version=’3.0.5′

客户端配置：
[root@client ~]# tail -1 /etc/syslog.conf
*.* @192.168.90.20

[root@client ~]# logger -i just one test
[root@client ~]# tail -1 /var/log/messages
Jan 27 22:12:02 client root[2861]: just one test
[root@server2 ~]# cat /var/log/syslog-ng/20100128/192.168.90.10/messages
Jan 28 04:24:32 192.168.90.10 root[2861]: just one test

[root@server2 ~]# cat /var/log/syslog-ng/20100128/192.168.90.10/secure
Jan 28 04:01:04 192.168.90.10 sshd[2832]: Accepted publickey for root from 192.168.90.1 port 48834 ssh2
Jan 28 04:01:04 192.168.90.10 sshd[2832]: pam_unix(sshd:session): session opened for user root by (uid=0)

前面配置好了 syslog-ng, 下面简要的概述下如何将系统日志存入 mysql
1：将 mysql 的头文件和库文件链接到 /usr/local 下
[root@server2 ~]# ln -s /usr/local/mysql/lib/mysql /usr/local/lib/mysql
[root@server2 ~]# ln -s /usr/local/mysql/include/mysql/ /usr/local/include

[root@server2 ~]# cd /usr/local/src/software/sqlsyslogd
2：下载 sqlsyslogd 源码包，由于是整个目录下载，所以会下载 index.html 打头的索引文件

更多详情见请继续阅读下一页的精彩内容 ：http://www.linuxidc.com/Linux/2014-06/103053p2.htm

[root@server2 software]# wget -d -r -np http://www.frasunek.com/sources/security/sqlsyslogd/
[root@server2 software]# cd www.frasunek.com/sources/security/sqlsyslogd/
[root@server2 sqlsyslogd]# rm -rf index.html*
[root@server2 sqlsyslogd]# cd contrib/
[root@server2 contrib]# rm -rf index.html*
[root@server2 contrib]# cd
[root@server2 ~]# mv /usr/local/src/software/www.frasunek.com/sources/security/sqlsyslogd/ /usr/
local/src/software/
3:make, 复制 sqlsyslogd 二进制程序到 /usr/local/sbin 目录下
[root@server2 ~]# cd /usr/local/src/software/sqlsyslogd/
[root@server2 sqlsyslogd]# make
cc -O6 -Wall -pipe -I/usr/local/include -DCONF=\”/usr/local/etc/sqlsyslogd.conf\” -L/usr/local/lib/mysql -lmysqlclient sqlsyslogd.c -o sqlsyslogd
[root@server2 sqlsyslogd]# cp sqlsyslogd /usr/local/sbin/
4：执行下 sqlsyslogd 程序，出现下面的命令选项则说明安装成功
[root@server2 sqlsyslogd]# sqlsyslogd
usage: sqlsyslogd [-h hostname] <-u username> [-p] <-t table> [database]
5：修改 /etc/ld.so.conf 文件，并使其生效，这个文件维护着编译的动态链接库位置
[root@server2 sqlsyslogd]# cat /etc/ld.so.conf
include ld.so.conf.d/*.conf
/usr/local/lib/mysql
[root@server2 sqlsyslogd]# ldconfig

6：在数据库中创建相应的库和表
[root@server2 sqlsyslogd]# mysql
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 158
Server version: 5.1.36-log Source distribution

Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the current input statement.

mysql> create database syslog;
Query OK, 1 row affected (0.00 sec)

mysql> use syslog
Database changed
mysql> create table logs (Id int(10) NOT NULL auto_increment,Timestamp varchar(16),Host varchar(50),Prog varchar(50),Mesg text,PRIMARY KEY (id));
Query OK, 0 rows affected (0.01 sec)

mysql> exit
Bye

7：该文件定义了连接数据库的密码
[root@server2 sqlsyslogd]# cat /usr/local/etc/sqlsyslogd.conf
123456

8：在 syslog-ng 主配置文件中添加下列配置
[root@server2 sqlsyslogd]# vi /usr/local/syslog-ng/etc/syslog-ng.conf

destination sqlsyslogd{
program(“/usr/local/sbin/sqlsyslogd -u root -t logs syslog -p”);
};

log {
source(s_remote);
destination(sqlsyslogd);
};

9: 重启 syslog-ng 服务
[root@server2 sqlsyslogd]# service syslog-ng restart
Stopping Kernel Logger: [OK]
Starting Kernel Logger: [OK]

10: 客户端发消息测试
[root@server2 sqlsyslogd]# tail -1 /var/log/syslog-ng/20100226/192.168.90.1/messages
Feb 26 14:25:47 192.168.90.1 root[6058]: just for fun

上面的安装步骤中 syslog-ng.conf 文件的配置不够形象，下面再详细贴一个 syslog-ng.conf 的简单配置作为参考：

#############################################################################
# Default syslog-ng.conf file which collects all local logs into a
# single file called /var/log/messages.
#

@version: 3.3
@include “scl.conf”

source s_local {
system();
internal();
};

source s_network {
tcp(ip(0.0.0.0) port(514));
udp(ip(0.0.0.0) port(514));
};

filter f_outbound {
level(info..emerg);
host(“ip|ip”) and program(“^node-syslog-outbound”);
};

destination d_local {
file(“/var/log/messages”);
};

destination d_network {
file(“/opt/apps/log/$YEAR$MONTH$DAY$HOUR$MIN.log” create_dirs(yes));
};

log {
#source(s_local);
#destination(d_local);
source(s_network);
filter(f_outbound);
destination(d_network);
};

filter f_inbound {
level(info..emerg);
host(“ip|ip”) and program(“^node-syslog-inbound”);
};

destination d_inbound {
file(“/opt/apps/log_inbound/$YEAR$MONTH$DAY$HOUR$MIN.log” create_dirs(yes));
};

log {
source(s_network);
filter(f_softbound);
destination(d_softbound);
};

以上就配置好了日志收集机器了，但是其它生产机怎么将日志发过来呢？

因为其它生产机默认采用的 syslogd 写 syslog 的，而 syslogd 自带有发送日志到网络上，只需要添加配置即可。

在 /etc/syslog.conf 上添加一行：

*.* @ip

syslogd 就会将服务器上的 sysylog 发送到这个 ip 上面，默认连接的端口是 514，这一点可以在 syslog-ng 的配置里面看到。

ok，一个日志收集搭建完毕。