想找一起研究PHP-SYSLOG-NG问题的人

yylking

最近想想学安全方面的东西，就想做一个PHP—SYSLOG—NG的东东，想做得好一点，发现网上这方面的中文文档好少，找不到，如果有想一起研究的请留言，或给我MAIL：yyl-2002@163.com

我的初步思想是这样的，用MYSQL作日志服务器的记录器，用PHP做前端的日志分板和展示用，用syslog-ng做日志记录工具，通过管道传入到MYSQL数据库，而PHP也是通过MYSQL的数据来做展示，

说实话，PHP-SYSLOG-NG以经把这个问题解决的不错了，但是网上中文的文档真的好少，我的英文很差，好想找老师帮助我一下，主要是在优先级和数据的挖掘上，我很差，如果有好的中文说明，我在这里先谢谢各位前辈了

双眼皮的猪

挺好的东西,ng在处理日志粒度上比syslog强多了,但是我们要用c写这个接口,字符处理太麻烦了,还是用perl好^_^

你学会了记得教教我...

yylking

呵呵，如果我学会了，一定会告诉大家，只是现在我对于日志的优先级别什么的还不是很懂，只是知道有这个软件，我刚到网络部实习，经理就给我这个任务，我最近在看资料呢，大家一起帮帮我，如果有这方面的资料，大家贴出来，

archangle

我现在的系统和你构想的一样,唯一不一样的就是我是用syslog来做日志系统.syslog-ng还没听过.

archangle

看起来这是一个商业系统,不是开源的?

yylking

此文件整理有關 syslog-ng + mysql + php-syslog-ng 的安裝筆記,用以集中數台Linux主機的 logs 於 Mysql database 上以利於檢視分析.
如有任何錯誤請不吝指正.

http://samlin2004.myweb.hinet.net/docs/log/syslog-ngInstallationGuide.htm



Centralized syslog-ng to Mysql Installation Guide
--------------------------------------------------------------------------------

1.Requirement

OS: Red Hat 9.0
Database: MySQL 4.0.20
Web Server: Apache2
PHP Supported.

Packages:
syslog-ng-1.6.5.tar.gz
libol-0.3.14.tar.gz
php-syslog-ng-2.5.1.tar.gz
　

2.Installation

2.1 Install libol-0.3.14.tar.gz

The Libol package contains support libraries needed by Syslog-ng.

2.1.1 Prepare Libol for compilation
#tar zxvf libol-3.0.14.tar.gz
#./configure --prefix=/usr --enable-shared

2.1.2 Compile Libol
#make

2.1.3 Install
#make install

2.2 Install syslog-ng-1.6.5.tar.gz

2.2.1 Prepare Syslog-ng for compilation
#tar zxvf syslog-ng-1.6.5.tar.gz
#./configure --prefix=/usr --sysconfdir=/etc

2.2.2 Compile Syslog-ng
#make

2.2.3 Install
#make install　

2.3 Extract php-syslog-ng-2.5.1.tar.gz

Extract php-syslog-ng-2.5.1.tar.gz under Apache's document root (ex: /usr/local/apache2/htdocs)
　

3.Configuration

3.1 Create Database Schema

3.1.1 Edit syslog-ng.sql script for creating log database schema

=== syslog-ng.sql script start here ===

CREATE DATABASE syslog;

USE syslog;

CREATE TABLE logs (
host varchar(32) default NULL,
facility varchar(10) default NULL,
priority varchar(10) default NULL,
level varchar(10) default NULL,
tag varchar(10) default NULL,
date date default NULL,
time time default NULL,
program varchar(15) default NULL,
msg text,
seq int(10) unsigned NOT NULL auto_increment,
PRIMARY KEY (seq),
KEY host (host),
KEY seq (seq),
KEY program (program),
KEY time (time),
KEY date (date),
KEY priority (priority),
KEY facility (facility)
) TYPE=MyISAM;
　

=== syslog-ng.sql script end here ===

3.1.2 Run the command to install the database into mysql.

#mysql -u YOURACCOUNT -p < syslog-ng.sql　

3.2 Edit syslog-ng.conf

Edit syslog-ng.conf (default installation path will be /usr/local/etc/syslog-ng/ depends on your installation prefix argument)

=== Configuration file start here ===

options
{
chain_hostnames(no);
create_dirs (no);
dir_perm(0755);
dns_cache(yes);
keep_hostname(yes);
log_fifo_size(204;
log_msg_size(8192);
long_hostnames(on);
perm(0644);
stats(3600);
sync(0);
time_reopen (10);
use_dns(yes);
use_fqdn(yes);
};

#----------------------------------------------------------------------
# Sources
#----------------------------------------------------------------------
# For Linux
#----------------------------------------------------------------------
source s_stream
{ unix-stream("/dev/log"; };

source s_internal
{ internal(); };

source s_kernel
{ pipe("/proc/kmsg" log_prefix("kernel: "); };

source s_tcp
{ tcp(port(4800) keep-alive(yes) max_connections(100)); };

#----------------------------------------------------------------------
# Piping method
#----------------------------------------------------------------------
destination database { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOURMINSEC', '$PROGRAM', '$MSG' );\n" template-escape(yes)); };

#----------------------------------------------------------------------
# Logging to a database
#----------------------------------------------------------------------

log { source(s_stream);
source(s_internal);
source(s_kernel); destination(database); };

=== Configuration file end here ===　

3.3 Pipe and startup script

3.3.1 Setup syslog-ng run as a daemon

(1)Edit /etc/rc.d/init.d/syslog-ng as below,

=== syslog-ng script start here ===

################################################################################
#
# Program: syslog-ng init script for Red Hat
#
################################################################################
# the following information is for use by chkconfig
# if you are want to manage this through chkconfig (as you should), you must
# first must add syslog-ng to chkconfig's list of startup scripts it
# manages by typing:
#
# chkconfig --add syslog-ng
#
# DO NOT CHANGE THESE LINES (unless you know what you are doing)
# chkconfig: 2345 12 88
# description: syslog-ng is the next generation of the syslog daemon. \
# syslog-ng gives you the flexibility of logging not only by facility and \
# severity, but also by host, message content, date, etc. it can also replace \
# klogd's function of logging kernel messages
#
# This following block of lines is correct, do not change! (for more info, see
# http://www.linuxbase.org/spec/refspecs/LSB_1.1.0/gLSB/facilname.html)
### BEGIN INIT INFO
# Provides: $syslog
### END INIT INFO
################################################################################
#
# This is an init script for syslog-ng on the Linux platform.
#
# It totally relies on the Redhat function library and works the same
# way as other typical Redhat init scripts.
#
#
# Platforms (tested): Linux (Redhat 7.3)
#
#
# Author: Gregor Binder <gbinder@sysfive.com>;
# Changed: October 10, 2000
#
# Last Changed: September 27, 2002
# Updated by: Diane Davidowicz
# changes: Brought the start script up to snuff as far as compliance
# with managing the startup script through chkconfig;
# added PATH variable ability to hook in path to syslog-ng (if
# its necessary); converted init script format to the
# standard init script format in Red Hat (7.3 to be exact)
# including using the /etc/sysconfig/syslog-ng file to
# managed the arguments to syslog-ng without changing this
# script, and disabled klogd but noted where and under what
# conditions it should be enabled. HAPPY LOGGING.
#
# Copyright (c) 2000 by sysfive.com GmbH, All rights reserved.
#
#
################################################################################
#
# configuration
#

INIT_PROG="/usr/local/sbin/syslog-ng" # Full path to daemon
INIT_OPTS="" # options passed to daemon

#
# Source Redhat function library.
#
. /etc/rc.d/init.d/functions

# Tack on path to syslog-ng if not already in PATH
SYSLOGNG_PATH=":/usr/local/sbin"

PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin
INIT_NAME=`basename "$INIT_PROG"`

# /etc/sysconfig/ is the standard way to pull in options for a daemon to use.
# Source config
if [ -f /etc/sysconfig/syslog-ng ] ; then
. /etc/sysconfig/syslog-ng
else
SYSLOGNG_OPTIONS=
fi

RETVAL=0

umask 077
ulimit -c 0

# See how we were called.
start() {
echo -n "Starting $INIT_PROG: "
#daemon $INIT_PROG $SYSLOGNG_OPTIONS
daemon --check $INIT_PROG "$INIT_PROG $INIT_OPTS"
RETVAL=$?
echo

[ $RETVAL -eq 0 ] && touch "/var/lock/subsys/${INIT_NAME}"
return $RETVAL
}

stop() {

echo -n "Stopping $INIT_PROG: "
killproc $INIT_PROG
RETVAL=$?
echo

[ $RETVAL -eq 0 ] && rm -f "/var/lock/subsys/${INIT_NAME}"
return $RETVAL

}

rhstatus() {
status $INIT_PROG
}

restart() {
stop
start
}

case "$1" in
start)
start
;;
stop)
stop
;;
status)
rhstatus
;;
restart|reload)
restart
;;
condrestart)
[ -f /var/lock/subsys/syslog-ng ] && restart || :
;;
*)
echo $"Usage: $0 {start|stop|status|restart|reload}"
exit 1
esac

exit $?

=== syslog-ng script end here ===

(2)Set as startup script

#chmod ugo+x /etc/rc.d/init.d/syslog-ng
#chkconfig --add syslog-ng　

3.3.2 Setup mysql-pipe file run as startup

(1)Edit /etc/rc.d/init.d/sqlsyslogd as below,

=== sqlsyslogd script start here ===

#!/bin/bash
#
# sqlsyslogd This is a daemon that takes syslog-ng input and pipe it into
# a MySQL database.
#
# chkconfig: 2345 98 10
# description: sqlsyslogd bridges syslog-ng and mysql.
# author: Josh Kuo Thu 2004/08/12 13:21:56 PDT

. /etc/rc.d/init.d/functions

case "$1" in
start)
if [ -x /tmp/mysql.pipe ]; then
mkfifo /tmp/mysql.pipe
else
# if the service is already running, do not start another one
PIDS=`pidofproc mysql`
if [ "$PIDS" ]; then
echo "sqlsyslogd is already running."
exit 1
fi
mysql -u YOURACCOUNT -h YOURMYSQLSERVERNAME -pYOURPASSWORD syslog < /tmp/mysql.pipe &

#If you need to collect apache logs into mysql, uncomment the following two lines.
#tail -f /usr/local/apache2/logs/access_log | logger -p info -t apache &
#tail -f /usr/local/apache2/logs/error_log | logger -p notice -t apache &

fi
;;
stop )
killproc mysql
#If you need to collect apache logs into mysql, uncomment the next line.
#killproc tail
;;

*)
echo "Usage: sqlsyslogd {start|stop}"
exit 1;
esac
exit 0;
=== sqlsyslogd script end here ===

(2)Set as startup script

#chmod ugo+x /etc/rc.d/init.d/sqlsyslogd
#chkconfig --add sqlsyslogd

3.4 Start the services

Run the following command or reboot the system.

#service syslog-ng start
#service sqlsyslogd start
　

4.Syslog-ng Monitor
4.1 Modify db_fns.php

(1)Configure the database function of php include file. YOURDOCROOT/YOURFOLDERNAME/includes/db_fns.php

=== db_fns.php start here ===

<?php

function db_connect_syslog()
{
$result = mysql_pconnect("YOURMYSQLSERVERNAME", "YOURACCOUNT", "YOURPASSWORD";
if (!$result)
return false;
if (!mysql_select_db("syslog")
return false;

return $result;
}

?>;

=== db_fns.php end here ===

(2)Monitor from browser

http://YOURHOST/YOURFOLDERNAME/index.php

yylking

这是我看到过的唯一的可用的中文的说明，我感觉也不错，实现也不难，只是我不是很明白中间的原理，因为我想更好的做好的，我想学好原理，再加个LIDS，或密罐程序。一起使用，但是我明白原理，希望高手给于指点原理，我对这个也看了好久，可能我真的笨，希望看到傻爪教程。嘻嘻，不过不是很的过程，但我想知道日志的优先级是如何曲分，和警告的信息，以及Mail通知，也有可能实时关机。请高手指教

yylking

我想做个中文开源的，希望大家支持，也希望大家对中国的开源做出贡献。我会得很少，大家一起帮忙。一起学习，

yylking

我很想学习网络安全，大家一起努力呀

yylking

怎么没有人来呀，自已顶一下吧