Chinaunix首页 | 论坛 | 博客

0x1024的ChinaUnix博客

首页　| 　博文目录　| 　关于我

0x1024

  • 博客访问： 21410
  • 博文数量： 4
  • 博客积分： 0
  • 博客等级： 民兵
  • 技术积分： 10
  • 用 户 组： 普通用户
  • 注册时间： 2013-12-11 17:45
文章分类

全部博文（4）

文章存档

2013年（4）

我的朋友
最近访客
推荐博文
相关博文
syslog-ng搭建集中日志服务器

分类： LINUX

2013-12-11 17:53:55

原文地址：syslog-ng搭建集中日志服务器 作者：zooyo

syslog-ng的强大功能在此呈现

首先切换到/etc目录
cd /etc

vi log.profile
  1. #日志存放路径
  2. PT=/var/log/ipwall/

  4. #客户端白名单(以逗号分割)
  5. IP=192.168.2.1,192.168.2.30

  7. #磁盘剩余空间大小(单位GB)
  8. SP=10

  10. #日志转储切割大小(单位MB)
  11. SZ=50

vi syslog-ng.example
  1. @version: 3.2
  2. #版本号具体数值参考 /etc/syslog-ng/syslog-ng.conf 文件第一行

  4. options { long_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no);
  5.           owner("root"); group("adm"); perm(0640); stats_freq(0);
  6.           bad_hostname("^gconfd$");
  7. };

  9. source s_net { udp(ip(0.0.0.0) port(514)); };

  11. destination d_session { file("__PATH__/$HOST/session/messages.log" perm(0777) dir_perm(0777) create_dirs(yes)); };
  12. destination d_url { file("__PATH__/$HOST/url/messages.log" perm(0777) dir_perm(0777) create_dirs(yes)); };
  13. destination d_qq { file("__PATH__/$HOST/QQ/messages.log" perm(0777) dir_perm(0777) create_dirs(yes)); };
  14. destination d_msn { file("__PATH__/$HOST/msn/messages.log" perm(0777) dir_perm(0777) create_dirs(yes)); };
  15. destination d_alipay { file("__PATH__/$HOST/alipay/messages.log" perm(0777) dir_perm(0777) create_dirs(yes)); };
  16. destination d_dns { file("__PATH__/$HOST/dns/messages.log" perm(0777) dir_perm(0777) create_dirs(yes)); };
  17. destination d_pop3 { file("__PATH__/$HOST/pop3/messages.log" perm(0777) dir_perm(0777) create_dirs(yes)); };
  18. destination d_others { file("__PATH__/$HOST/others/messages.log" perm(0777) dir_perm(0777) create_dirs(yes)); };

  20. filter f_local3 { level(info) and facility(local3); };
  21. filter f_host { host("__IP__"); };
  22. filter f_session { level(info) and facility(local1) and filter(f_host); };
  23. filter f_url { level(info) and facility(local2) and filter(f_host); };
  24. filter f_qq { filter(f_local3) and message(^qq) and filter(f_host); };
  25. filter f_msn { filter(f_local3) and message(^msn) and filter(f_host); };
  26. filter f_alipay { filter(f_local3) and message(^alipay) and filter(f_host); };
  27. filter f_dns { filter(f_local3) and message(^dns) and filter(f_host); };
  28. filter f_pop3 { filter(f_local3) and message(^pop3) and filter(f_host); };
  29. filter f_others { not facility(local1, local2, local3) and filter(f_host); };

  31. log { source(s_net); filter(f_session); destination(d_session); };
  32. log { source(s_net); filter(f_url); destination(d_url); };
  33. log { source(s_net); filter(f_qq); destination(d_qq); };
  34. log { source(s_net); filter(f_msn); destination(d_msn); };
  35. log { source(s_net); filter(f_alipay); destination(d_alipay); };
  36. log { source(s_net); filter(f_dns); destination(d_dns); };
  37. log { source(s_net); filter(f_pop3); destination(d_pop3); };
  38. log { source(s_net); filter(f_others); destination(d_others); };

vi logrotate.example
  1. __PATH__/__IP__/session/messages.log {
  2.         missingok
  3.         rotate 65535
  4.         create 0777 syslog adm
  5.         compress
  6.         size __SZ__M
  7.         dateext
  8.         dateformat .%s
  9.         postrotate
  10.         /bin/kill -HUP $(/bin/cat /var/run/syslog-ng.pid 2>/dev/null) &>/dev/null
  11.         endscript
  12. }

  14. __PATH__/__IP__/url/messages.log {
  15.         missingok
  16.         rotate 65535
  17.         create 0777 syslog adm
  18.         compress
  19.         size __SZ__M
  20.         dateext
  21.         dateformat .%s
  22.         postrotate
  23.         /bin/kill -HUP $(/bin/cat /var/run/syslog-ng.pid 2>/dev/null) &>/dev/null
  24.         endscript
  25. }

  27. __PATH__/__IP__/QQ/messages.log {
  28.         missingok
  29.         rotate 65535
  30.         create 0777 syslog adm
  31.         compress
  32.         size __SZ__M
  33.         dateext
  34.         dateformat .%s
  35.         postrotate
  36.         /bin/kill -HUP $(/bin/cat /var/run/syslog-ng.pid 2>/dev/null) &>/dev/null
  37.         endscript
  38. }

  40. __PATH__/__IP__/msn/messages.log {
  41.         missingok
  42.         rotate 65535
  43.         create 0777 syslog adm
  44.         compress
  45.         size __SZ__M
  46.         dateext
  47.         dateformat .%s
  48.         postrotate
  49.         /bin/kill -HUP $(/bin/cat /var/run/syslog-ng.pid 2>/dev/null) &>/dev/null
  50.         endscript
  51. }

  53. __PATH__/__IP__/alipay/messages.log {
  54.         missingok
  55.         rotate 65535
  56.         create 0777 syslog adm
  57.         compress
  58.         size __SZ__M
  59.         dateext
  60.         dateformat .%s
  61.         postrotate
  62.         /bin/kill -HUP $(/bin/cat /var/run/syslog-ng.pid 2>/dev/null) &>/dev/null
  63.         endscript
  64. }

  66. __PATH__/__IP__/dns/messages.log {
  67.         missingok
  68.         rotate 65535
  69.         create 0777 syslog adm
  70.         compress
  71.         size __SZ__M
  72.         dateext
  73.         dateformat .%s
  74.         postrotate
  75.         /bin/kill -HUP $(/bin/cat /var/run/syslog-ng.pid 2>/dev/null) &>/dev/null
  76.         endscript
  77. }

  79. __PATH__/__IP__/pop3/messages.log {
  80.         missingok
  81.         rotate 65535
  82.         create 0777 syslog adm
  83.         compress
  84.         size __SZ__M
  85.         dateext
  86.         dateformat .%s
  87.         postrotate
  88.         /bin/kill -HUP $(/bin/cat /var/run/syslog-ng.pid 2>/dev/null) &>/dev/null
  89.         endscript
  90. }

  92. __PATH__/__IP__/others/messages.log {
  93.         missingok
  94.         rotate 65535
  95.         create 0777 syslog adm
  96.         compress
  97.         size __SZ__M
  98.         dateext
  99.         dateformat .%s
  100.         postrotate
  101.         /bin/kill -HUP $(/bin/cat /var/run/syslog-ng.pid 2>/dev/null) &>/dev/null
  102.         endscript
  103. }

vi syslog.install
  1. #/bin/bash

  3. . /etc/log.profile
  4. cd /etc
  5. rm -f /etc/logrotate.d/ipwall
  6. PT=${PT%%/}
  7. [ -d $PT ] || mkdir -p $PT
  8. NUM=$(awk -vRS=, 'END{print NR}' <<<$IP)

  10. SED_F(){
  11.     sed "s,__PATH__,$PT,;s,__IP__,$1,;s,__SZ__,$SZ," logrotate.example >> /etc/logrotate.d/ipwall
  12. }

  14. if [[ $NUM == 1 ]];then
  15.     NIP=$(sed 's/.*/^&$/' <<<$IP)
  16.     SED_F $IP
  17. else
  18.     NIP=$(sed 's/.*/^&$/;s/,/$\\\\|^/g' <<<$IP)
  19.     awk -vRS=",|\n" '1' <<<$IP | while read LINE;do SED_F $LINE;done
  20. fi

  22. sed "s,__PATH__,$PT,;s,__IP__,$NIP," syslog-ng.example > /etc/syslog-ng/syslog-ng.conf

  24. service syslog-ng restart 1>/dev/null

  26. RELEASE=$(lsb_release -a 2>/dev/null | awk -F":[ \t]+" '/Distributor ID/{print $2}')

  28. if [[ $RELEASE == "Ubuntu" ]];then
  29.     CRON=/var/spool/cron/crontabs/root
  30. else
  31.     CRON=/var/spool/cron/root
  32. fi
  33. chmod 755 /etc/rotate /etc/monipartition
  34. if [ -f $CRON ];then
  35.     sed -i '/rotate\|monipartition/d' $CRON
  36.     echo -e "* * * * * . /etc/profile;/etc/rotate\n10 0 * * * /etc/monipartition" >> $CRON
  37. else
  38.     echo "Crontab installation failed"
  39. fi
  40. useradd syslog
  41. exit 0



vi rotate
  1. #!/bin/bash

  3. . /etc/log.profile

  5. MOVE_F(){
  6.         cd $1
  7.         ls *.gz 2>/dev/null|/usr/bin/awk -F"_" 'NR==1{i=$1;system("mkdir -p "i"")}{if($1==i)system("mv "$0" "i"")}'
  8. }

  10. /usr/sbin/logrotate /etc/logrotate.conf

  12. /usr/bin/find $PT -name "messages.log.*.gz" | /usr/bin/awk -F'messages\\.log\\.' '{split($NF,a,".");system("mv "$0" "$1"`date -d \"@"a[1]"\" +%Y-%m-%d_%H-%M`.gz")}'

  14. /usr/bin/find $PT -maxdepth 2 -type d | /bin/sed 'N;/^\(.\+\)\n\1/!P;D' | while read LINE;do MOVE_F $LINE;done

  16. exit 0

vi monipartition
  1. #!/bin/bash

  3. . /etc/log.profile

  5. SPACE=$(df $PT | awk 'NR==2{print $4}')
  6. SP=$(($SP*100000))

  8. RM_F(){
  9.     cd $1
  10.     ls -d */ 2>/dev/null | awk 'NR==1{system("rm -rf "$0"")}'
  11. }

  13. [[ $SPACE -le $SP ]] && /usr/bin/find $PT -maxdepth 2 -type d | /bin/sed 'N;/^\(.\+\)\n\1/!P;D' | while read LINE;do RM_F $LINE;done

  15. exit 0

文件全部保存在 /etc 目录下，给安装脚本 syslog.install 加执行权限，执行该脚本。
ubuntu 11.04  syslog-ng 3.13 测试通过,如果是syslog-ng 3.1.2 版本请把配置文件的版本号改为：@version: 3.0

syslog-ng管理员手册（英文版）：

参考网站:
阅读(2410) | 评论(0) | 转发(0) |
0

上一篇：没有了

下一篇：syslog-ng配置说明

给主人留下些什么吧！~~
关于我们 | 关于IT168 | 联系方式 | 广告合作 | 法律声明 | 免费注册

Copyright 2001-2010 ChinaUnix.net All Rights Reserved 北京皓辰网域网络信息技术有限公司. 版权所有

感谢所有关心和支持过ChinaUnix的朋友们

16024965号-6