搭建syslog服务器流程模板.docx

1. 安装系统a) 安装要求i. PC配置：CPU：Intel P E2160（1.8GHz）以上内存：1G以上硬盘：80G以上虚拟机要求：Kernel：linux 2.6内存：512以上硬盘：40G以上 b) 安装系统i. Linux syslog server要求用centos 5.5下载地址：ed2k:/|file|CentOS.5.5.32bit光盘镜像.CentOS-5.5-i386-bin-DVD.iso|a1ce64b6d36d945f562cb1250d8d665f|h=fnfai2pqdbdxmz5i5wshkaj22ttscbkg|/c) 配置网络i. 点击桌面上方系统管理网络，配置eth0和DNSii. Network Abapter修改为桥接模式2. 安装工具a) 安装GCC和makerootFDWIN # yum install gcc makeb) 安装LAMP平台rootFDWIN # yum install php-mysql mysql mysql-server php-snmp php-pdo perl-DBDMySQL httpd php yrootFDWIN # service mysqld startrootFDWIN # chkconfig mysqld onrootFDWIN #service httpd startrootFDWIN #chkconfig httpd onrootFDWIN # mysqladmin -uroot password 000000rootFDWIN #vim /var/www/html/index.php添加：然后网页访问下出现OK说明没问题了。进入centosDVD盘然后安装rpm -vih php-gd-5.1.6-15.el5.i386.rpm进入centosDVD盘然后安装rpm -ivh freetype-2.2.1-19.el5.i386.rpmc) 安装NET-SNMP1. 下载net-snmp源码，并解压rootFDWIN proc#wget 5.6/net-snmp-5.6.tar.gzrootFDWIN proc#tar -xvzf net-snmp-5.6.tar.gz2. Configurea) 进入源文件目录rootFDWIN proc#cd net-snmp-5.6b) ConfigurerootFDWIN proc#./configure -prefix=/usr/local/net-snmp enable-mfd-rewrites-with-default-snmp-version=”2” -with-persistent-directory=”/var/net-snmp”3. 编译、安装rootFDWIN proc#make & make install4. 配置snmpd.confa) 将EXAMPLE.conf文件复制到/usr/local/net-snmp/share/snmp/snmpd.confrootFDWIN proc#cp EXAMPLE.conf /usr/local/net-snmp/share/snmp/snmpd.confb) 修改snmpd.conf1.查找以下字段：# sec.name source communitycom2sec notConfigUser default public将comunity字段改为你要设置密码.比如bizcnpublic.将“default”改为你想哪台机器能够看到你snmp信息,如10.10.10.10。授权服务器IP2.查找以下字段：# Finally, grant the group read-only access to the systemview view.# group context sec.model sec.level prefix read write notifaccess notConfigGroup any noauth exact systemview none none将read字段改为all.代码:#access notConfigGroup any noauth exact all none none3.查找以下字段：# incl/excl subtree mask#view all included .1 80将该行前面#去掉.4.查找以下字段：#name incl/excl subtree mask(optional)添加一行view all included .1变成#name incl/excl subtree mask(optional)view all included .15.查找以下字段：#view mib2 included .iso.org.dod.internet.mgmt.mib-2 fc将该行前面#去掉.保留、关闭c) 设置net-snmp自开启rootFDWIN proc#chkconfig -level 35 snmpd onrootFDWIN proc#chkconfig -add snmpdd) SNMP测试（本机）rootFDWIN proc#snmpwalk -v -2c -c public FDWIN若有大量数据返回，说明SNMP配置正确e) 防火墙打开udp 161端口f) 检验SNMP服务是否运行rootFDWIN proc#netstat -ln |grep 161udp 0 0 127.0.0.1:161 0.0.0.0:* 表示SNMP已运行正常3. CACTI安装a) RRDtool安装1.cgilibwget tar -zxvf cgilib-0.5.tar.gzcd cgilib-0.5makecp libcgi.a /usr/local/libcp cgi.h /usr/include2.fontconfigwget cd fontconfig-2.8.0./configuremake & make install3.pixmanwget cd pixman-0.21.2./configuremake;make install4.cairowget tar -zxvf cairo-1.10.0.tar.gzcd cairo-1.10.0export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH #这里很关键./configuremake;make install5.pangowget 1.17.5.tar.gztar -zxvf pango-1.17.5.tar.gzcd pango-1.17.5./configuremake & make install6.rrdtoolwget tar -xvzf rrdtool-1.4.4.tar.gzcd rrdtool-1.4.4./configure prefix=/usr/local/rrdtoolmake;make isntallb) Cacti安装1.下载Cacti软件包，并安装到/var/www/html/cactiwget tar -xvzf cacti-0.8.7g.tar.gzmv cacti-0.8.7g /var/www/html/cacti2.配置数据库mysql -u root -p 123456mysql create database cacti;mysql grant all privileges on cacti.* to cactiFDWIN identified by cactiwith grant option;mysql grant all privileges on cacti.* to cacti127.0.0.1 identified by cactiwith grant option;mysqlflush privileges;mysql use cacti;mysql source /var/www/html/cacti/cacti.sql;3.配置Cacti以连接数据库vi /var/www/html/cacti/include/config.php 依据以下修改：/* make sure these values refect your actual database/host/user/password */$database_type = mysql;$database_default = cacti;$database_hostname = FDWIN;$database_username = cacti;$database_password = cacti;$database_port = 3306;vi /var/www/html/cacti/include/global.php 依据以下修改：/* Default database settings*/$database_type = mysql;$database_default = cacti;$database_hostname = FDWIN;$database_username = cacti;$database_password = cacti;$database_port = 3306;$configurl_path = /cacti/;4.添加cacti用户rootFDWIN proc#useradd -s nologin cactirootFDWIN proc#passwd cacti5.修改cacti目录属主rootFDWIN proc#chown -R cacti:cacti /var/www/html/cacti/6.编辑crontabrootFDWIN proc#crontab -e*/5 * * * * /usr/bin/php /var/www/html/cacti/poller.php /dev/null 2&17.关闭SELinuxrootFDWIN proc#setenforce 08.用浏览器访问http:/FDWIN/cacti/9.配置Cacti首先点开settingspath页，正确设置对应路径，然后finish保留10.安装补丁根据C上步骤，打上补丁程序必需在Cacti安装目录下，即/var/www/html/cacti/rootFDWIN proc#wget rootFDWIN proc#wget rootFDWIN proc#wget rootFDWIN proc#wget rootFDWIN proc#wgetrootFDWIN proc#wget rootFDWIN proc#wget rootFDWIN proc#patch -p1 -N data_source_deactivate.patchpatch -p1 -N graph_list_view.patchpatch -p1 -N html_output.patchpatch -p1 -N ldap_group_authenication.patchpatch -p1 -N script_server_command_line_parse.patchpatch -p1 -N ping.patchpatch -p1 -N poller_interval.patch4. CACTI配置和插件必需现安装好插件扩展PIA 2.8，才能安装、使用其它插件wget tar -xvzf cacti-plugin-0.8.7g-PA-v2.8.tar.gzmv cacti-plugin-arch /var/www/html/cacti/cd /var/www/html/cacti/mysql -u root -p 123456 cacti cacti-plugin-arch/pa.sqlpatch -p1 -N admin or other user - Realm Permissions - PluginManagement - 打勾并保留3. 安装插件a)下载插件wget wget wget wget wget wget wget wget reportit_v061/reportit_v061.tar.gzwget b)解压插件tar -xvzf settings.tar.gztar -xvzf monitor.tar.gztar -xvzf realtime.tar.gztar -xvzf syslog.tar.gztar -xvzf thold.tar.gztar -xvzf tools.tar.gztar -xvzf update.tar.gztar -xvzf reportit_v06.tar.gztar -xvzf npc-2.0.4.tar.gzc)修改global.php，增加插件说明vi /var/www/html/cacti/include/global.php$plugins = settings;$plugins = thold;$plugins = npc;$plugins = syslog;$plugins = aggregate;$plugins = reportit;$plugins = update;$plugins = tools;d)下载安装json（NPC插件需要json支持）wget tar -xvzf json-1.2.1.tgz/usr/bin/phpize # 假如phpize 没有此指令，请yum安装php-devel包./configuremake & make installe) 修改权限将全部插件mv到/var/www/html/cacti/plugins目录下，然后User Management - adminor other user - Realm Permissions - Plugin Management - 打勾并保留f) 启用插件点击configuration下plugins management,将各个插件install/enable。4. 插件安装排错a）realtime插件安装问题realtim插件安装好后，点击web界面graphs页，选一个图，可发觉在其右下角已经出现了一个realtimelogo，但当点此logo进行realtime查看时，会发觉弹出窗口中显示：“The image cache directory doesnt exist.Please create it and set permissionsand then attempt to open an other realtime graph.”提醒没有Cache目录和权限等。处理方案：rootlocalhost proc#makedir /var/www/html/cacti/cacherootlocalhost proc#chmod 777 -R /var/www/html/cacti/cache以后，还要进入console-configuration-settings-misc,设置”Cache Directory”为/var/www/html/cacti/cache/b) Syslog插件安装问题在cacti中访问syslog栏目是会出现以下提醒：1 Warning: include(./include/html/inc_timespan_settings.php) function.include:failed to open stream: No such file or directory in/var/www/html/plugins/syslog/syslog.php on line 1262 Warning: include() function.include: Failed opening./include/html/inc_timespan_settings.php for inclusion(include_path=.:/usr/share/pear) in /var/www/html/plugins/syslog/syslog.php online 126只需将/plugins/syslog/syslog.php第126行#include($syslog_configgraphtime ? ./include/html/inc_timespan_settings.php: plugins/syslog/html/syslog_timespan_settings.php);修改为：#include($syslog_configgraphtime ?./lib/timespan_settings.phpplugins/syslog/html/syslog_timespan_settings.php);即可5. 搭建SYSLOG 日常Linux服务器全部会安装syslogd或rsyslog等日志监控服务。不过，因为日志文件全部已文本形式放到服务器上，一个一个去查找还是比较麻烦。不过使用cacti能够为我们找到一条捷径。1. 安装syslog-ng服务Syslog-ng，下一代syslog服务。Cactisyslog监控插件只支持这一个日志服务。rootFDWIN proc#yum install syslog-ng2. 配置syslog插件rootFDWIN proc#cd /var/www/html/cacti/plugins/syslog/rootFDWIN proc#vi config.php$syslogdb_type = mysql;$syslogdb_default = syslog;$syslogdb_hostname = FDWIN;$syslogdb_username = ;$syslogdb_password = ;3. 配置数据库rootFDWIN proc#mysql -u root -p 123456mysqlcreate database syslog;mysqlgrant all on syslog.* to cactiloaclhost;mysqlflush privileges;mysqlexit;mysql ucacti p syslog syslog.sql4. 配置syslog-ng.confvi /etc/syslog-ng/syslog-ng.confversion: 3.0options keep_hostname(yes);long_hostnames(off);flush_lines(1);log_fifo_size(1024);create_dirs(yes); # if a dir does not exist create itowner(root); # owner of created filesgroup(root); # group of created filesperm(0600); # permissions of created filesdir_perm(0700); # permissions of created dirs;source net udp();destination d_mysql pipe(/tmp/mysql.pipetemplate(INSERT INTO cacti.syslog_incoming (host, facility, priority, date,time, message) VALUES ( $HOST, $FACILITY, $PRIORITY, $YEAR-$MONTH-$DAY,$HOUR:$MIN:$SEC, $MSG );n)template-escape(yes);log source(net); destination(d_mysql); ;log source(s_all);destination(d_mysql);source s_all internal();unix-stream(/dev/log);file(/proc/kmsg program_override(kernel: );destination single-file file(/var/log/syslog-ng/all-messages);rootFDWIN proc#service syslog-ng restart #重启syslog-ng5. 数据搜集rootFDWIN proc#vi /var/www/html/cacti/plugins/syslog/log2sql.sh#!/bin/bashif ! -e /tmp/mysql.pipe ; thenmkfifo /tmp/mysql.pipefiwhile -e /tmp/mysql.pipe domysql -u cacti -password=cacti cacti /tmp/mysql.pipedonerootFDWIN proc#chmod a+x log2sql.shrootFDWIN proc#vi /etc/rc.local/var/www/html/cacti/plugins/syslog/log2sql.sh &rootFDWIN proc#crontab -e -u cacti*/1 * * * * /usr/bin/php /usr/share/cacti/plugins/syslog/syslog_process.php6. Syslog Screenshot