配置rhel 6.4(64位)安装使用syslog-ng 3.5

我基本的博客地址是:www.cppblog.com/zdhsoft

相应的CentOS 6.x也就可能使用。

下载地址：

第一步：安装

wget http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.5.4.1/source/syslog-ng_3.5.4.1.tar.gz

wget http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.5.4.1/source/eventlog_0.2.12%2B20120504%2B1700.tar.gz

tar xvf eventlog_0.2.12+20120504+1700.tar.gz 

cd eventlog-0.2.12+20120504+1700

./configure --prefix=/usr/local/services/eventlog 

make 

make install 

cd ..

tar -xvf syslog-ng_3.5.4.1.tar.gz 

cd syslog-ng-3.5.4.1/

export PKG_CONFIG_PATH=/usr/local/services/eventlog/lib/pkgconfig 

./configure --prefix=/usr/local/services/syslog-ng

#假设提示no package 'glib-2.0' found centos

#那么就用yum install libgnomeui-devel

make

make install

第二步：加入服务

配置

将syslog-ng加入为系统服务, 

vim /etc/init.d/syslog-ng  #内容例如以下 

################################################################################

#!/bin/bash 

#  

# chkconfig: -  60 27 

# description: syslog-ng SysV script.  

. /etc/rc.d/init.d/functions 

 

syslog_ng=/usr/local/services/syslog-ng/sbin/syslog-ng 

prog=syslog-ng 

pidfile=/usr/local/services/syslog-ng/var/syslog-ng.pid 

lockfile=/usr/local/services/syslog-ng/var/syslog-ng.lock 

RETVAL=0 

STOP_TIMEOUT=${STOP_TIMEOUT-10} 

 

start() { 

        echo -n $"Starting $prog: " 

        daemon --pidfile=$pidfile $syslog_ng $OPTIONS 

        RETVAL=$? 

        echo 

        [ $RETVAL = 0 ] && touch ${lockfile} 

        return $RETVAL 

} 

 

stop() { 

    echo -n $"Stopping $prog: " 

    killproc -p $pidfile -d $STOP_TIMEOUT $syslog_ng 

    RETVAL=$? 

    echo 

    [ $RETVAL = 0 ] && rm -f $lockfile $pidfile 

} 

 

case "$1" in 

  start) 

    start 

    ;; 

  stop) 

    stop 

    ;; 

  status) 

        status -p $pidfile $syslog_ng 

    RETVAL=$? 

    ;; 

  restart) 

    stop 

    start 

    ;; 

  *) 

    echo $"Usage: $prog {start|stop|restart|status}" 

    RETVAL=2 

esac 

exit $RETVAL 

##################################################################################

#启动服务

chmod a+x /etc/init.d/syslog-ng 

killall syslogd 

chkconfig --add syslog-ng 

chkconfig syslog-ng on 

service syslog-ng start 

第三步：实际配置

命令 vi /usr/local/services/syslog-ng/etc/syslog-ng.conf

#################################################################################################### 

#############################################################################

# Default syslog-ng.conf file which collects all local logs into a

# single file called /var/log/messages.

#

@version: 3.5

@include "scl.conf"

options {

        create_dirs(yes);

        dir_perm(0755);

        use_dns(no);

        perm(0644);

        chain_hostnames(off);

        stats_freq(30);

};

source s_local {

        system();

        internal();

};

source s_network {

        udp(ip("0.0.0.0") port(514));

};

destination d_local {

        file("/var/log/messages");

};

log {

        source(s_local);

        # uncomment this line to open port 514 to receive messages

        source(s_network);

        destination(d_local);

};

template t_onlymsgip { template("$MSGONLY|$SOURCEIP\n"); };

template t_onlymsg { template("$MSGONLY\n"); };

filter f_cgioss { program("CGI") and level(crit); };

destination d_cgioss { file("/usr/local/services/lzlog/cgioss/$YEAR$MONTH/$YEAR$MONTH$DAY-$HOUR.oss" template(t_onlymsg)); };

log { source(s_network); filter(f_cgioss); destination(d_cgioss); flags(final);};

##### CGI ERR #####

filter f_cgierr { program("CGI") and level(err); };

destination d_cgierr { file("/usr/local/services/lzlog/cgierr/$YEAR$MONTH/$YEAR$MONTH$DAY-$HOUR.err" template(t_onlymsgip)); };

log { source(s_network); filter(f_cgierr); destination(d_cgierr); };

##### CGI LOG #####

filter f_cgilog { program("CGI") ; };

destination d_cgilog { file("/usr/local/services/lzlog/cgilog/$YEAR$MONTH/$YEAR$MONTH$DAY-$HOUR.log" template(t_onlymsgip)); };

destination d_minutecgilog { file("/usr/local/services/lzlog/cgilog/$YEAR$MONTH/$YEAR$MONTH$DAY-$HOUR-$MIN.log" template(t_onlymsgip)); };

#log { source(s_network); filter(f_cgilog); destination(d_minutecgilog); };

log { source(s_network); filter(f_cgilog); destination(d_cgilog); flags(final);};

#### SVR BILL #####

#如今量少，不用分10个文件

filter f_svrbill { program("SVR") and level(info); };

destination d_svrbill { file("/usr/local/services/lzlog/svrbill/$YEAR$MONTH/$YEAR$MONTH$DAY-$HOUR.oss" template(t_onlymsg)); };

log { source(s_local); filter(f_svrbill); destination(d_svrbill); flags(final);};

filter f_paybill { program("PAY"); };

destination d_paybill { file("/usr/local/services/lzlog/paybill/$YEAR$MONTH/$YEAR$MONTH$DAY-$HOUR.oss" template(t_onlymsg)); };

log { source(s_local); filter(f_paybill); destination(d_paybill); flags(final);};

###########################################################################################################