Ubuntu : Centralized Log with LogZilla

Centralized Log with LogZilla
1. ดาวน์โหลดและติดตั้ง LogZilla

1. sudo su -
2. cd /var/www
3. wget http://php-syslog-ng.googlecode.com/files/logzilla_v2.9.9o.tgz
4. tar xzvf logzilla_v2.9.9o.tgz
5. mv php-syslog-ng logzilla
6.  

2.ติดตั้ง และ config syslog-ng

1. aptitude install syslog-ng

แก้ไข /etc/syslog-ng/syslog-ng.conf

1. options {
2.       long_hostnames(off);
3.       # doesn't actually help on Solaris, log(3) truncates at 1024 chars
4.       log_msg_size(8192);
5.       # buffer just a little for performance
6.       # sync(1); <- Deprecated - use flush_lines() instead
7.       flush_lines(1);
8.       # memory is cheap, buffer messages unable to write (like to loghost)
9.       log_fifo_size(16384);
10.       # Hosts we don't want syslog from
11.       #bad_hostname("^(ctld.|cmd|tmd|last)$");
12.       # The time to wait before a dead connection is reestablished (seconds)
13.       time_reopen(60);
14.       #Use DNS so that our good names are used, not hostnames
15.       use_dns(yes);
16.       dns_cache(yes);
17.       #Use the whole DNS name
18.       use_fqdn(yes);
19.       keep_hostname(yes);
20.       chain_hostnames(no);
21.       #Read permission for everyone
22.       perm(0644);
23.       # The default action of syslog-ng 1.6.0 is to log a STATS line
24.       # to the file every 10 minutes.  That's pretty ugly after a while.
25.       # Change it to every 12 hours so you get a nice daily update of
26.       # # how many messages syslog-ng missed (0).
27.       # stats(43200);
28.   };
29.  
30. ### Sources ###
31. source s_net {
32. udp(ip(0.0.0.0) port(514));
33. tcp(ip(0.0.0.0) port(514) keep-alive(yes) max-connections(300));
34. };
35.  
36. source s_local {
37. # message generated by Syslog-NG
38. internal();
39. # standard Linux log source (this is the default place for the syslog()
40. # function to send logs to)
41. unix-stream("/dev/log");
42. # messages from the kernel
43. file("/proc/kmsg" log_prefix("kernel: "));
44. };
45.  
46. ### Destinations ###
47. destination d_messages { file("/var/log/messages"); };
48.  
49. destination d_logzilla {
50.   program("/var/www/logzilla/scripts/db_insert.pl"
51.   template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n")
52.   );
53. };
54.  
55. ### Logs ###
56. log {
57. source(s_local);
58. destination(d_messages);
59. };
60.  
61. log {
62.    source(s_local);
63.    source(s_net);
64.    destination(d_logzilla);
65. };

3.ติดตั้ง Package อื่น ๆ ที่จำเป็น

1. aptitude install apache2 php5 php5-gd php5-cli php5-mysql mysql-server msttcorefonts build-essential
2. cpan Text::LevenshteinXS
3. cpan -i Digest::SHA1
4. cpan -i Net::MySQL

4.Config Apache กับ PHP

1. nano /etc/php5/apache2/php.ini

1. nano /etc/php5/cli/php.ini

แก้ไขให้เป็น

1. memory_limit = 128M
2. max_execution_time = 300
3.  

1. nano /etc/apache2/conf.d/logzilla

1. Alias /logs "/var/www/logzilla/html/"
2.    <Directory "/var/www/logzilla/html/">
3.        Options Indexes MultiViews FollowSymLinks
4.        AllowOverride All
5.    Order allow,deny
6.    Allow from all
7.    </Directory>
8.  

restart apache

1. /etc/init.d/apache2 restart
2. chown -R www-data:www-data /var/www/logzilla/html

5.Logrotate

1. mkdir -p /var/log/logzilla
2. nano /etc/logrotate.conf

1. /var/log/logzilla/*.log {
2.   missingok
3.   compress
4.   rotate 5
5.   daily
6.   postrotate
7.   /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true
8.   endscript
9. }

ตั้งเวลา

1. crontab -e

1. @daily php /var/www/logzilla/scripts/logrotate.php >> /var/log/logzilla/logrotate.log
2. @daily find /var/www/logzilla/html/jpcache/ -atime 1 -exec rm -f '{}' ';'
3. 0,5,10,15,20,25,30,35,40,45,50,55 * * * * php /var/www/logzilla/scripts/reloadcache.php >> /var/log/logzilla/reloadcache.log

6.Setup LogZilla

1. cd /var/www/logzilla/html
2. chmod 777 ./config/config.php
3. chmod 777 ./config
4. chmod 777 ./jpcache
5. touch lpd_graph.jpeg
6. chmod 777 lpd_graph.jpeg

เข้าไปที่ http://server/logs แล้วทำตามขั้นตอนไปเรื่อย ๆ
step 1 ป้อนแค่รหัสผ่าน mysql ของ root อย่างอื่นปล่อยเป็น default ไว้
step 3 ตรง site url ใส่ /logs/ ตามที่ตั้งค่า apache ไว้ แล้วใส่ email กับตั้งรหัสผ่านของ admin
step 4 คลิก Install CEMDB (Cisco Error Message Database) แล้วก็ Import จนเสร็จ
เข้าไปแก้ไข path ต่าง ๆ โดยใช้ script

1. cd /var/www/logzilla/scripts
2. ./fixpaths.sh
3.