loganalyzer/install.sh
#apachemysql
#װrsyslog
yum install rsyslog
#װrsyslogmysqlģ飬ʹ֮Խ־дmysql
yum install rsyslog-mysql

#޸rsyslogļ
vi /etc/rsyslog.conf

#һеעȥrsyslogUDP514˿ڣͻ˻ὫԼ־͵˵UDP514˿
$ModLoad imudp
$UDPServerRun 514

$ModLoad ommysql.so   #¼ӴУrsyslogmysqlģ
*.* :ommysql:localhost,Syslog,rsyslog,123456  #¼ӴУrsyslogʹûrsyslog,־дmysqlSyslogУ123456ûrsyslog

#rsyslogҪݿ
cd /usr/share/doc/rsyslog-mysql-5.8.10/
mysql -u root -p < createDB.sql  #òᴴSyslog⣬кűеSystemEventsloganalyzerҪȡı


grant all privileges on Syslog.* to rsyslog@'localhost' identified by '123456';

flush privileges;

#rsyslog

service rsyslog restart #ĻʱSystemEventsӦѾдݣΪrsyslogѾʼ־洢mysql

#ϲʹrsyslogϵͳ־дmysqlװloganalyzer,ǽ־mysqlwebʽչʾ

#loganalyzer

wget http://download.adiscon.com/loganalyzer/loganalyzer-3.6.3.tar.gz

#apacheԷʵλôĿ¼loganalyzerĳ
mkdir /data/www/loganalyzer

tar zxvf loganalyzer-3.6.3.tar.gz
cd loganalyzer-3.6.3

#װļƵloganalyzerĿ¼

cp -a src/* /data/www/loganalyzer/
cp -a contrib/* /data/www/loganalyzer/

cd /data/www/loganalyzer

sh configure.sh #config.phpļдȨ

http://ip/loganalyzer  #webװ

װɺִsecure.sh,config.phpȨ޸Ϊ644


#ʾipַĬloganalyzerֻʾ־Դ־̨ʾ־ԴIP

#SyslogеSystemEventsһֶΣ¼ԴIP
ALTER TABLE SystemEvents ADD FromIP VARCHAR(60) DEFAULT NULL AFTER FromHost;

#޸rsyslog.conf

#ݵrsyslogڽ־дMysqlʱԴIPд뵽FromIPֶΣloganalyzerȡ־ʱſȡipϢ
$template insertpl,"insert into SystemEvents (Message, Facility, FromHost, FromIP, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', '%fromhost-ip%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL

$ModLoad ommysql.so
*.* :ommysql:localhost,Syslog,rsyslog,123456;insertpl

#rsyslog

#Աݵ¼loganalyzerAamin Center½Field  View DBmappingȻµviewʾҳϾͻipϢ

#fieldıviewЩʾҳϣDBmappingfieldȡʲôֵ






