日志管理

image.png
image.png

端口514
rpm -qi sysklogd(syslogd and klogd)  centos5
rpm -qi rsyslog  centos6/7
vim /etc/ssh/sshd_config  看一下即可
    SyslogFacility AUTHPRIV
    #LogLevel INFO  info及以上级别的日志会被记录
man logger  
man 3 syslog
  facility 设施，从功能或程序上对日志进行归类
    auth, authpriv, cron,...
  Priority 优先级别，从低到高排序 level
    debug, info, notice,...
日志定义的规则: facility Priority 定义到那个文件里
rpm -ql rsyslog
判断开机是否启动
systemctl is-enabled rsyslog  centos7
systemctl status rsyslog  centos7
chkconfig --list rsyslog  centos6
配置文件格式：由三部分组成
    MODULES：相关模块配置
    GLOBAL DIRECTIVES：全局配置
    RULES：日志记录相关的规则配置
vim /etc/rsyslog.conf  看一下RULES配置格式
    RULES配置格式： facility.priority; facility.priority… target
logger "This is a test log"
tail /var/log/messages 
tail -f /var/log/secure  显示用户登陆的事件信息
centos6: ssh 192.168.28.127

把登陆的日志信息重新写入我们自己指定的文件
vim /etc/ssh/sshd_config
#SyslogFacility AUTHPRIV  注释掉，并添加信息：
SyslogFacility local0
LogLevel INFO
systemctl restart sshd
vim /etc/rsyslog.conf
在最下面添加信息
local0.*        /var/log/sshd.log
ll /var/log/sshd.log  目前未生成
centos6: ssh 192.168.28.127
ll /var/log/sshd.log  生成

用户登陆通知root和fgq用户
vim /etc/rsyslog.conf
local0.*        root,fgq
systemctl restart rsyslog
ctrl+alt+f2: fgq登陆
centos6: ssh 192.168.28.127
此时centos7的root和fgq用户会收到centos6的登陆信息
恢复默认设置

网路的日志服务：日志记录在远程的服务器上
监听端口配置在服务器上，客户端端口随机的，不用配置
centos6的日志信息发送到centos7(服务器)上
配置rsyslog服务端
centos7
vim /etc/rsyslog.conf  
把监听端口打开，去掉注释，使下面的信息生效
$ModLoad imudp   此时走的是udp协议
$UDPServerRun 514
systemctl restart rsyslog  
ss -nul  514端口
配置rsyslog客户端
centos6
logger "this is a centos6 log"
cat /var/log/messages
vim /etc/rsyslog.conf  
#*.info;mail.none;authpriv.none;cron.none                /var/log/messages
*.info;mail.none;authpriv.none;cron.none                @192.168.29.127
service rsyslog restart
测试
centos6: logger "this is a centos6 log2"
centos7: tail -f /var/log/messages  出现centos6的信息，centos6本机不再记录其日志信息
centos6: logger "this is a centos6 log3"

centos6的日志信息发送到centos7(服务器)上，centos5登陆centos6的日志也会记录在centos7上
配置rsyslog客户端
centos6
vim /etc/ssh/sshd_config
#SyslogFacility AUTH
#SyslogFacility AUTHPRIV
#LogLevel INFO
SyslogFacility local1
vim /etc/rsyslog.conf
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
#*.info;mail.none;authpriv.none;cron.none                @192.168.29.127
local1.*          @@192.168.29.127  两个@@就是走的tcp协议
service rsyslog restart; service sshd restart
配置rsyslog服务端
centos7
vim /etc/rsyslog.conf
$ModLoad imtcp  tcpd端口打开，udp先不关闭
$InputTCPServerRun 514
local1.*        /var/log/sshd.log
systemctl restart rsyslog
ss -ntul    tcp和udp的514端口都有
tail -f /var/log/sshd.log  
centos6: service rsyslog restart; service sshd restart
测试
centos7: tail -f /var/log/sshd.log
centos5: ssh 192.168.29.126
centos7: tail -f /var/log/sshd.log
centos6: tail -f /var/log/sshd.log  也有centos5的登陆日志信息存在

tail -f /var/log/secure  显示用户登陆的事件信息
/var/log/secure：系统安装日志，文本格式，应周期性分析
/var/log/btmp：当前系统上，用户的失败尝试登录相关的日志信息，二进制格式，lastb命令进行查看
/var/log/wtmp：当前系统上，用户正常登录系统的相关日志信息，二进制格式，last命令可以查看
/var/log/lastlog: 每一个用户最近一次的登录信息，二进制格式，lastlog命令可以查看
/var/log/dmesg：系统引导过程中的日志信息，文本格式文本查看工具查看专用命令dmesg查看
/var/log/messages ：系统中大部分的信息
/var/log/anaconda : anaconda的日志

centos6-3向centos6上发送日志
centos6  rsyslog服务器
vim /etc/rsyslog.conf
去掉注释，udp和tcp都开启，就可以接收其他主机往此机器上发送日志
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
service rsyslog restart  
centos6-3(ip: 192.168.29.132)  rsyslog客户端
vim /etc/rsyslog.conf
#*.info;mail.none;authpriv.none;cron.none            /var/log/messages
*.info;mail.none;authpriv.none;cron.none             @192.168.29.126
service rsyslog restart
logger "this is a centos6-3 log"
logger "this is a centos6-3 log1"
logger "this is a centos6-3 log2"
logger "this is a centos6-3 log3"
centos6
tail /var/log/messages  
不还原，为下面实验做铺垫

rsyslog将日志记录于MySQL中
mysql server  centos7
rsyslog  centos6
配置MySQL服务器
centos7
关闭防火墙
yum groupinstall mariadb mariadb-client 
rpm -ql mariadb-server
rpm -ql mariadb 客户端
systemctl start mariadb 
ss -ntlp 显示程序
mysql
grant all on Syslog.* to 'sysloguser'@'192.168.%.%' identified by '123456';
flush privileges;  授权即时生效
quit
vim /etc/my.cnf
[mysqld]添加信息
skip_name_resolve = on
innodb_file_per_table = on
systemctl restart mariadb.service
systemctl status mariadb.service
ss -ntl
mysql -usysloguser -p -h 192.168.29.127
quit
mysql_secure_installation  禁止匿名用户登陆
mysql -uroot -p
输入密码; quit
配置rsyslog端
centos6 
关闭防火墙
yum install mysql -y 
重启服务
yum list rsyslog*; 
yum -y install rsyslog-mysql
rpm -ql rsyslog-mysql
less /usr/share/doc/rsyslog-mysql-5.8.10/createDB.sql  包含sql命令语句
mysql -usysloguser -p -h 192.168.29.127  可以登陆上
mysql -usysloguser -p -h 192.168.29.127 < /usr/share/doc/rsyslog-mysql-5.8.10/createDB.sql
centos7: 
mysql -usysloguser -p -h 192.168.29.127
show databases;
use Syslog;
show tables;  
不退出
配置rsyslog将日志保存到mysql中
centos6 
vim /etc/rsyslog.conf
去掉注释，udp和tcp都开启
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
#### MODULES ####  添加下面信息
$ModLoad ommysql
#### RULES ####
#*.info;mail.none;authpriv.none;cron.none    /var/log/messages  注释掉
*.info;mail.none;authpriv.none;cron.none  :ommysql:192.168.29.127,Syslog,sysloguser,123456
service rsyslog restart
logger "this is a centos6 log3"
logger "this is a centos6 log4"
centos7: 
未断开，接着做
select count(*) from SystemEvents;
select count(*) from SystemEventsProperties;
select * from SystemEvents;
select * from SystemEvents\G  看的更加清晰点


通过loganalyzer在前端展示数据库中的日志
centos7 做mysql的数据库，已做
centos6 做前端展示
centos6
(1) 在rsyslog服务器上准备amp或nmp组合
yum -y install httpd php php-mysql php-gd(图形显示日志文件)
vim /var/www/html/index.php
<?php
      $conn = mysql_connect('192.168.29.127','sysloguser','123456');
      if ($conn)
          echo "OK";
      else
          echo "failure";
phpinfo();
?>
service httpd restart
浏览器：192.168.29.126  OK
(2) 安装LogAnalyzer
LogAnalyzer包下载地址：http://loganalyzer.adiscon.com/
cd /usr/local/src
rz  上传
tar xvf loganalyzer-4.1.6.tar.gz; ls
cd loganalyzer-4.1.6; ls
ll contrib/; ll src/
mv contrib/* src/; ls
cd /var/www/html/loganalyzer; ll
chmod  +x *.sh
./configure.sh
./secure.sh  
二者运行完成会生成config.php，但是为空
ll config.php install.php
chmod 666 config.php
(3) 配置loganalyzer
浏览器：192.168.29.126/loganalyzer/install.php  进行安装
next
next
next
MySQL Native, Syslog Fields, Monitorware
Database Host                192.168.29.127
Database Name                Syslog
Database Tablename           SystemEvents
Database User                sysloguser
Database Password            123456 
next
finish
菜单栏选项：
点击 Statistics 
在centos6-3上：接着上面的实验
logger "this is a centos6-3 log10"
logger "this is a centos6-3 log11"
此时浏览器页面的Statistics的图形发生变化

image.png
image.png