centos 7 配置 loganalyzer

0. 准备工作

操作系统:Centos 7.x

loganalyzer 服务端：192.168.10.74

loganalyzer 客户端：192.168.10.71

systemctl stop firewalld.service

systemctl disable firewalld.service

setenforce 0

sed -i '/SELINUX/s/enforcing/disabled/' /etc/selinux/config

1. 安装lamp环境并测试

yum -y install httpd PHP PHP-gd PHP-mcrypt PHP-MysqL mariadb-devel mariadb-server

systemctl start httpd.service

systemctl enable httpd.service

#创建测试页面

echo -e "<?PHP\nPHPinfo();\n?>" >/var/www/html/index.PHP

#进浏览器输入http://192.168.10.74

#如果不能显示测试页面，请返回重新检查以前步骤

#如果能显示测试页面，删除index.PHP继续向下走

rm -f /var/www/html/index.PHP

2. 数据库的安全初始化

systemctl start mariadb.service

systemctl enable mariadb.service

MysqL_secure_installation

#Enter current password for root (enter for nonE):

#Change the root password? [Y/n]

#以下2步是让你输入密码，其它地方回车就可以了

#New password:

#Re-enter new password:

#Remove anonymous users? [Y/n]

#Disallow root login remotely? [Y/n]

#Remove test database and access to it? [Y/n]

#Reload privilege tables Now? [Y/n]

3. 创建数据库用户并授权

yum -y install rsyslog-MysqL

MysqL -uroot -p < /usr/share/doc/rsyslog-7.4.7/MysqL-createdb.sql

MysqL -uroot -p

grant all on Syslog.* to rsysloguser@127.0.0.1 identified by 'rsyslogpwd';

grant all on Syslog.* to rsysloguser@localhost identified by 'rsyslogpwd';

flush privileges;

quit

4. 服务端配置

vi /etc/rsyslog.conf

#去掉注释

$ModLoad immark # immark是模块名，支持日志标记

$ModLoad imudp # imupd是模块名，支持udp协议

$UDPServerRun 514 #允许514端口接收使用UDP和TCP协议转发过来的日志

#添加以下信息

$ModLoad omMysqL

*.* :omMysqL:localhost,Syslog,rsysloguser,rsyslogpwd

#重启服务

systemctl restart rsyslog.service

6. 客户端配置

vi /etc/rsyslog.conf

#在文件结尾处增加此内容

*.* @192.168.10.74:514

#重启服务

systemctl restart rsyslog.service

7. loganalyzer准备工作

wget http://download.adiscon.com/loganalyzer/loganalyzer-4.1.5.tar.gz

tar xf loganalyzer-4.1.5.tar.gz

cp -a loganalyzer-4.1.5/src/ /var/www/html/log

cp -a loganalyzer-4.1.5/contrib/*.sh /var/www/html/log/

cd /var/www/html/log

chmod +x configure.sh secure.sh

./configure.sh

./secure.sh

chmod 666 config.PHP

chown -R apache.apache *

8. 进浏览器输入http://192.168.10.74/log/ 进行安装

在客户端安装一个程序包测试一下吧！！！！！！

我的天“涯”，貌似，可能，好像，也许，大概是成功了……