Rsyslog LogAnalyzer 配置.docx

首先安装apache,php,mysql为了方便这个我就使用yum安装tar -xvf rsyslog-5.8.6.tar.gz解压./configure --prefix=/usr/local/rsyslog --enable-mysql开始编译安装 –enable-mysql打开mysql支持这里一般会遇到一个错误../runtime/.libs/librsyslog.a(librsyslog_la-parser.o): In function `uncompressMessage:/root/rsyslog-5.8.6/runtime/parser.c:247: undefined reference to `uncompresscollect2: ld returned 1 exit statusmake[2]: *** [rsyslogd] Error 1make[2]: Leaving directory `/root/rsyslog-5.8.6/toolsmake[1]: *** [all-recursive] Error 1make[1]: Leaving directory `/root/rsyslog-5.8.6make: *** [all] Error 2解决办法：rsyslog-5.8.6]# vim runtime/parser.c注释247行//ret = uncompress((uchar *) deflateBuf, iLenDefBuf, (uchar *) pszMsg+1, lenMsg-1);重新编译Make cleanMake make installrsyslog-5.8.6]# cp rsyslog.conf /etc/vim /etc/rsyslog.conf?添加如下两行$ModLoad ommysql*.* :ommysql:localhost,Syslog数据库,用户名,密码去掉如下两行前的注释$ModLoad imudp.so # provides UDP syslog reception$UDPServerRun 514 # start a UDP syslog server at standard port 514完整配置文件如下：# if you experience problems, check# /troubleshoot for assistance# rsyslog v3: load input modules# If you do not load inputs, nothing happens!# You may need to set the module load path if modules are not found.$ModLoad immark # provides --MARK-- message capability$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)$ModLoad imklog # kernel logging (formerly provided by rklogd)$ModLoad ommysql*.* :ommysql:localhost,Syslog,xiaosan,123456# Log all kernel messages to the console.# Logging much else clutters up the screen.#kern.* /dev/console# Log anything (except mail) of level info or higher.# Dont log private authentication messages!*.info;mail.none;authpriv.none;cron.none -/var/log/messages# The authpriv file has restricted access.authpriv.* /var/log/secure# Log all the mail messages in one place.mail.* -/var/log/maill