首页 > 代码库 > 配置rhel 6.4(64位)安装使用syslog-ng 3.5

配置rhel 6.4(64位)安装使用syslog-ng 3.5

我主要的博客地址是:www.cppblog.com/zdhsoft
对应的CentOS 6.x也就可能使用!
下载地址:
第一步:安装
wget http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.5.4.1/source/syslog-ng_3.5.4.1.tar.gz
wget http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.5.4.1/source/eventlog_0.2.12%2B20120504%2B1700.tar.gz
tar xvf eventlog_0.2.12+20120504+1700.tar.gz 
cd eventlog-0.2.12+20120504+1700
./configure --prefix=/usr/local/services/eventlog 
make 
make install 
cd ..
tar -xvf syslog-ng_3.5.4.1.tar.gz 
cd syslog-ng-3.5.4.1/
export PKG_CONFIG_PATH=/usr/local/services/eventlog/lib/pkgconfig 
./configure --prefix=/usr/local/services/syslog-ng
#如果提示no package ‘glib-2.0‘ found centos
#那么就用yum install libgnomeui-devel
make
make install
第二步:添加服务
配置
将syslog-ng添加为系统服务, 
vim /etc/init.d/syslog-ng  #内容如下 
################################################################################
#!/bin/bash 
#  
# chkconfig: -  60 27 
# description: syslog-ng SysV script.  
. /etc/rc.d/init.d/functions 
 
syslog_ng=/usr/local/services/syslog-ng/sbin/syslog-ng 
prog=syslog-ng 
pidfile=/usr/local/services/syslog-ng/var/syslog-ng.pid 
lockfile=/usr/local/services/syslog-ng/var/syslog-ng.lock 
RETVAL=0 
STOP_TIMEOUT=${STOP_TIMEOUT-10} 
 
start() { 
        echo -n $"Starting $prog: " 
        daemon --pidfile=$pidfile $syslog_ng $OPTIONS 
        RETVAL=$? 
        echo 
        [ $RETVAL = 0 ] && touch ${lockfile} 
        return $RETVAL 
 
stop() { 
    echo -n $"Stopping $prog: " 
    killproc -p $pidfile -d $STOP_TIMEOUT $syslog_ng 
    RETVAL=$? 
    echo 
    [ $RETVAL = 0 ] && rm -f $lockfile $pidfile 
 
case "$1" in 
  start) 
    start 
    ;; 
  stop) 
    stop 
    ;; 
  status) 
        status -p $pidfile $syslog_ng 
    RETVAL=$? 
    ;; 
  restart) 
    stop 
    start 
    ;; 
  *) 
    echo $"Usage: $prog {start|stop|restart|status}" 
    RETVAL=2 
esac 
exit $RETVAL 
##################################################################################
#启动服务
chmod a+x /etc/init.d/syslog-ng 
killall syslogd 
chkconfig --add syslog-ng 
chkconfig syslog-ng on 
service syslog-ng start 
第三步:实际配置
命令 vi /usr/local/services/syslog-ng/etc/syslog-ng.conf
#################################################################################################### 
#############################################################################
# Default syslog-ng.conf file which collects all local logs into a
# single file called /var/log/messages.
#
@version: 3.5
@include "scl.conf"
options {
        create_dirs(yes);
        dir_perm(0755);
        use_dns(no);
        perm(0644);
        chain_hostnames(off);
        stats_freq(30);
};
source s_local {
        system();
        internal();
};
source s_network {
        udp(ip("0.0.0.0") port(514));
};
destination d_local {
        file("/var/log/messages");
};
log {
        source(s_local);
        # uncomment this line to open port 514 to receive messages
        source(s_network);
        destination(d_local);
};
template t_onlymsgip { template("$MSGONLY|$SOURCEIP\n"); };
template t_onlymsg { template("$MSGONLY\n"); };
filter f_cgioss { program("CGI") and level(crit); };
destination d_cgioss { file("/usr/local/services/lzlog/cgioss/$YEAR$MONTH/$YEAR$MONTH$DAY-$HOUR.oss" template(t_onlymsg)); };
log { source(s_network); filter(f_cgioss); destination(d_cgioss); flags(final);};
##### CGI ERR #####
filter f_cgierr { program("CGI") and level(err); };
destination d_cgierr { file("/usr/local/services/lzlog/cgierr/$YEAR$MONTH/$YEAR$MONTH$DAY-$HOUR.err" template(t_onlymsgip)); };
log { source(s_network); filter(f_cgierr); destination(d_cgierr); };
##### CGI LOG #####
filter f_cgilog { program("CGI") ; };
destination d_cgilog { file("/usr/local/services/lzlog/cgilog/$YEAR$MONTH/$YEAR$MONTH$DAY-$HOUR.log" template(t_onlymsgip)); };
destination d_minutecgilog { file("/usr/local/services/lzlog/cgilog/$YEAR$MONTH/$YEAR$MONTH$DAY-$HOUR-$MIN.log" template(t_onlymsgip)); };
#log { source(s_network); filter(f_cgilog); destination(d_minutecgilog); };
log { source(s_network); filter(f_cgilog); destination(d_cgilog); flags(final);};
#### SVR BILL #####
#现在量少,不用分10个文件
filter f_svrbill { program("SVR") and level(info); };
destination d_svrbill { file("/usr/local/services/lzlog/svrbill/$YEAR$MONTH/$YEAR$MONTH$DAY-$HOUR.oss" template(t_onlymsg)); };
log { source(s_local); filter(f_svrbill); destination(d_svrbill); flags(final);};
filter f_paybill { program("PAY"); };
destination d_paybill { file("/usr/local/services/lzlog/paybill/$YEAR$MONTH/$YEAR$MONTH$DAY-$HOUR.oss" template(t_onlymsg)); };
log { source(s_local); filter(f_paybill); destination(d_paybill); flags(final);};
###########################################################################################################