Cacti之syslogs监控服务器日志

syslog插件的下载及安装
//下载Cacti的plugin:syslog
[root@centos53 ~]# cd /usr/local/src
[root@centos53 src]# wget http://cactiusers.org/downloads/syslog.tar.gz
[root@centos53 src]# tar zxvf syslog-0.5.2.tar.gz
[root@centos53 src]# mv syslog /usr/local/cacti/plugins/
[root@centos53 src]# vi /usr/local/cacti/plugins/syslog/config.php
…..
$syslogdb_type     = ‘mysql’;
$syslogdb_default  = ‘syslog’;
$syslogdb_hostname = ‘localhost’;
$syslogdb_username = ‘syslog;
$syslogdb_password = ‘syslog’;
…..
[root@centos53 src]# vi /usr/local/cacti/plugins/global.php
$plugins = array();
$plugins[] = ‘settings’;
$plugins[] = ‘syslog’;
此时可以在[console]-[configuration]-[plguin management]中见到:syslog status:-Running,在[User Management]中,为admin用户分配View syslog和config syslog alerts/reports的权限。
//建立syslog数据库以及用syslog.sql建表等
[root@centos53 src]# mysql -uroot -p
mysql> create database syslog;
mysql> grant all on syslog.* to cacti@localhost identified by ‘cactipw’;
mysql> flush privileges;
mysql> exit;
[root@centos53 src]# mysql -uroot -p syslog </usr/local/cacti/plugins/syslog/syslog.sql

下面要用syslog-ng来接收日志,将结合shell将日志写到syslog数据库的syslog_incoming和syslog表中。
syslog-ng的下载、安装、配置
[root@centos53 src]# cd /usr/local/src
[root@centos53 src]# wget http://www.balabit.com/downloads/files/syslog-ng/sources/3.0.4/setups/rhel-5-i386/syslog-ng-3.0.4-1.rhel5.i386.rpm
[root@centos53 src]# rpm -ivh syslog-ng-3.0.4-1.rhel5.i386.rpm
warning: syslog-ng-3.0.4-1.rhel5.i386.rpm: Header V3 DSA signature: NOKEY, key ID 2aa28252
Preparing…                ########################################### [100%]
Shutting down kernel logger: [  OK  ]
Shutting down system logger: [  OK  ]
   1:syslog-ng              ########################################### [100%]
Starting syslog-ng: OK
[root@centos53 etc]# cd /opt/syslog-ng/etc/
[root@centos53 etc]# cp syslog-ng.conf syslog-ng.conf.bak
[root@centos53 etc]# vi /opt/syslog-ng/etc/syslog-ng.conf
@version: 3.0
options {
};
source net {
        udp();
};

destination d_mysql {
        pipe(“/tmp/mysql.pipe”
         template(“INSERT INTO syslog_incoming (host, facility, priority, date, time, message) VALUES ( ‘$HOST’, ‘$FACILITY’, ‘$PRIORITY’, ‘$YEAR-$MONTH-$DAY’, ‘$HOUR:$MIN:$SEC’, ‘$MSG’ );\n”)
         template-escape(yes)
        );
};
log { source(net); destination(d_mysql); };
SHELL的配置
[root@centos53 /]# vi /sbin/syslogtomysql
#!/bin/bash
if [ ! -e /tmp/mysql.pipe ]; then
        mkfifo /tmp/mysql.pipe
fi
while [ -e /tmp/mysql.pipe ]
do
        mysql -u cacti –password=cactipw syslog < /tmp/mysql.pipe
done
[root@centos53 /]# chmod 755 /sbin/syslogtomysql
[root@centos53 /]# echo “/sbin/syslogtomysql &” >> /etc/rc.d/rc.local
[root@centos53 /]# /sbin/syslogtomysql &
[root@centos53 /]# service syslog-ng restart
[root@centos53 /]# service mysqld restart
补充说明:
1)通过ps -ef | grep syslog,可以看到syslog工作的相关进程应有:
  supervising syslog-ng
  /opt/syslog-ng/sbin/syslog-ng –no-caps
  /bin/bash /sbin/syslogtomysql
  mysql -u cacti –password=x xxxxx syslog
2)在syslog数据库中,有以下5个表
  +——————+
  | Tables_in_syslog |
  +——————+
  | syslog           |
  | syslog_alert     |
  | syslog_incoming  |
  | syslog_remove    |
  | syslog_reports   |
  +——————+
  日志从客户机发过来后,先写入syslog_incoming表中,之后通过默认的300秒再进入syslog表,syslog表中记录通过cacti的syslog页面可以显示出来。所以要配置后一台客户机后,可以查syslog_incoming表,可5分钟后在页面中观察,还可以通过tcpdump,logger等命令进行协助分析遇到日志客户机与中心机的通信问题。
3)在cacti的[console]-[configureation]-[settings]-[misc]中,可以对Syslog Events进行相应设置。
4)在syslog中,如果主机名被显示为bogon,那么请改你的DNS服务器的地址(不要用219.141.136.10),建议通过/etc/hosts文件写明主机名与IP。
在cacti中访问syslog栏目是会出现以下提示:
Warning: include(./include/html/inc_timespan_settings.php) [function.include]: failed to open stream: No such file or directory in /var/www/html/plugins/syslog/syslog.php on line 126 Warning: include() [function.include]: Failed opening ‘./include/html/inc_timespan_settings.php’ for inclusion (include_path=’.:/usr/share/pear’) in /var/www/html/plugins/syslog/syslog.php on line 126
126行使用这个代替:include($syslog_config[“graphtime”] ? “./lib/timespan_settings.php” : “plugins/syslog/html/syslog_timespan_settings.php”);

此条目发表在Cacti分类目录。将固定链接加入收藏夹。