yum install mysql-server rsyslog rsyslog-mysql
If you are interested in storing syslog messages in MySQL so they could be viewed through a web page, using rsyslog in combination with phpLogCon is a good solution. This will also require php-mysql, php-gd and httpd.
If you have a different syslog application running then you'll need to stop and disable it.
# service syslog stop
# chkconfig -level 0123456 syslog off
# cp /etc/syslog.conf /etc/rsyslog.conf
# service rsyslog start
On some linux distros you'll have to create the Syslog database with the following. On others, it is created when the rsyslog-mysql package is installed.
# service mysqld start # mysql mysql> GRANT SELECT, UPDATE, INSERT ON Syslog.* TO rsyslog@localhost IDENTIFIED BY 'secret'; mysql> \q # mysql < /usr/share/doc/rsyslog-mysql-*/createDB.sql
CREATE DATABASE Syslog; USE Syslog; CREATE TABLE SystemEvents ( ID int unsigned not null auto_increment primary key, CustomerID bigint, ReceivedAt datetime NULL, DeviceReportedTime datetime NULL, Facility smallint NULL, Priority smallint NULL, FromHost varchar(60) NULL, Message text, NTSeverity int NULL, Importance int NULL, EventSource varchar(60), EventUser varchar(60) NULL, EventCategory int NULL, EventID int NULL, EventBinaryData text NULL, MaxAvailable int NULL, CurrUsage int NULL, MinUsage int NULL, MaxUsage int NULL, InfoUnitID int NULL , SysLogTag varchar(60), EventLogType varchar(60), GenericFileName VarChar(60), SystemID int NULL ); CREATE TABLE SystemEventsProperties ( ID int unsigned not null auto_increment primary key, SystemEventID int NULL , ParamName varchar(255) NULL , ParamValue text NULL );After the above steps have been done, you should found a new database named "Syslog" has been created (this is sometimes referred to as "Adiscon's MonitorWare Schema").
mysql> show databases;
Note: LogAnalyzer can be modified to support different database structures. My notes on the modifications required to support our syslog-ng tables are here.
add the following to /etc/rsyslog.conf and then restart rsyslog:
$ModLoad ommysql.so *.* :ommysql:localhost,Syslog,rsyslog,secret
Check /var/log/messages to confirm rsyslog started up and that there isn't any errors. You can also log into MySQL and take a look at the SystemEvents table to make sure data is being logged there. If you are using CentOS or Red Hat Enterprise Linux with SELinux enforcing mode, you will need to update the SELinux rules to allow rsyslog to talk to the MySQL socket:
# setenforce 0 # service rsyslog restart # cat /var/log/audit/audit.log | grep rsyslogd | audit2allow -M myselinuxmod; semodule -i myselinuxmod.pp # setenforce 1 # service rsyslog restart
Having the logs in MySQL is fine, but in order to make use of them and view them easily, LogAnalyzer (formerly phpLogCon) could be installed. It is a web-based front-end that will allow you to view the logs with a nice interface. The latest version can be downloaded from loganalyzer.adiscon.com/downloads. The tarball comes with an INSTALL file with the instructions on how to set it up; it's no more difficult than any other PHP web application. You can also install phplogcon with the yum command:
# yum install phplogcon
# service httpd restart
By default, the phplogcon config file is in /etc/httpd/conf.d/phplogcon.conf
By default, the configuration of phplogcon allows localhost access only. You have to made some changes to the phplogcon.conf to allow the phplogcon site can be access on other machines. For example, if your server's IP is 192.168.75.134 and you have a intranet with subnet 192.168.75.0/24 and you would like to allow all machines within this subnet are able to access phplogcon, change "Allow from 127.0.0.1 localhost" to "Allow from 192.168.75." in etc/httpd/conf.d/phplogcon.conf and then restart apache.
You can configure phpLogCon by opening a browser to http://192.168.75.134/loganalyzer/install.php and following the steps prompted. During the processes of configuration, it would check the file accessiblity of phplogconf. Under the SELinux enabled environment, the file config.php would be writeable by webserver by default. You have to solve this problem by invoke the follow command to change the SELinux context of the file:
# chcon -t httpd_sys_content_rw_t /etc/phplogcon/config.php
Once it is installed, you will be able to see the web interface at http://192.168.75.134/loganalyzer/index.php
Notes: Database settings are stored in config.php and table schema is defined in include/constants_logstream.php in the loganalyzer web root. Turning on debug info inside config.php may help you when configuring a new table schema. Additional notes are here.
If you would like your rsyslog be able to listen logs from remote systems,
for rsyslog version 2, you will need to edit /etc/sysconfig/rsyslog and change the SYSLOGD_OPTIONS to "-m 0 -r"
for rsyslog version 3 or newer, you have to edit /etc/rsyslog.conf and uncomment the following lines under MODULES:
$ModLoad imudp.so $UDPServerRun 514
After configuration has been changed, you have to restart the rsyslog by
# service rsyslog restart
You should found your machine is now listen to UDP port 514 for accept log messages from remote systems
# netstat -ntul | grep 514 udp 0 0 0.0.0.0:514 0.0.0.0:* udp 0 0 :::514 :::*
However, you have to edit iptables rules to allow incoming remote log messages traffic by
adding the following line at the top of the INPUT CHAIN of your IP tables:
# cd /etc/sysconfig/
# vi iptables
then ass "-A INPUT -m state -state NEW -m udp -p udp -dport 514 -j ACCEPT" to the top of INPUT chain
save the file and restart iptables by
# service iptables restart
# service mysql stop # mysqld_safe --skip-grant-tables # mysql -u root mysql> use mysql; mysql> update user set password=PASSWORD("secret") where User='root'; mysql> flush privileges; mysql> quit # service mysql restart # mysql -u root -psecret mysql>Retrieve list of mysql users:
# mysql -u root -psecret mysql> select * from mysql.user; mysql> select User from mysql.user; mysql> \q