![\"syslog01\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog01.jpg\" "\\"syslog01\\"")
<\/p>\n<\/p>\n
Rsyslog and LogAnalyzerare tools that help administrators to collect the systems log in a centralized place<\/strong> and facilitates the data analysis.<\/p>\n In large networks the number of devices installed provides tons of logs that make impossible to have a good overview\u00a0<\/strong>of the overall network status without having a centralized log collector system.<\/p>\n <\/p>\n <\/p>\n <\/p>\n First install LAMP environment and Rsyslog packages<\/strong> using the yum<\/em> command.<\/p>\n # yum install httpd php mysql php-mysql mysql-server rsyslog rsyslog-mysql wget <\/span><\/p>\n Prior importing the db schema into MySQL you can customize the database name<\/strong> (Syslog by default) by editing the createDB.sql<\/strong> file.<\/p>\n # vi \/usr\/share\/doc\/rsyslog-mysql-5.8.10\/createDB.sql<\/span><\/p>\n Once editing has been completed, import the db schema<\/strong> into MySQL. In the example, the procedure creates a new database called rsyslogdb<\/strong>.<\/p>\n # mysql -u root -p < \/usr\/share\/doc\/rsyslog-mysql-5.8.10\/createDB.sql<\/span><\/p>\n Grant the privileges<\/strong> to the account rsyslog.<\/p>\n # mysql -u root -p<\/span><\/p>\n $ModLoad imuxsock<\/span><\/p>\n # vi \/etc\/rsyslog.conf<\/span><\/p>\n Add also the following lines:<\/p>\n Enable the service to start at system boot<\/strong> and start the service.<\/p>\n # chkconfig rsyslog on If you have a firewall, you need to open ports TCP 514 and UDP 514<\/strong> to work with Rsyslog.<\/p>\n <\/p>\n To test if everything is working, check if messages are arriving<\/strong> at the syslog server.<\/p>\n # tail -f \/var\/log\/messages<\/span><\/p>\n In addition you can check if messages are being stored<\/strong> in MySQL database.<\/p>\n # mysql -u root -p<\/span><\/p>\n If you see an empty set<\/strong> means it\u2019s working.<\/p>\n <\/p>\n Using the command wget<\/em> download the LogAnalyzer package<\/strong>.<\/p>\n # wget http:\/\/download.adiscon.com\/loganalyzer\/loganalyzer-3.6.3.tar.gz<\/span><\/p>\n Unpack the downloaded file and move the content to the Apache document root<\/strong>.<\/p>\n # tar -vxzf loganalyzer-3.6.3.tar.gz Enter the created directory and assign the correct permissions<\/strong> to execute the scripts.<\/p>\n # cd \/var\/www\/html\/loganalyzer\/ <\/p>\n Access the web interface<\/strong> typing from your browser the following address:<\/p>\n http:\/\/IP_address\/loganalyzer<\/p><\/blockquote>\n At first access you receive an error message because the application hasn\u2019t been configured yet. Click on word\u00a0here<\/strong> to go ahead with the configuration.<\/p>\n Click Next<\/strong> to start the installation.<\/p>\n Click Next<\/strong> to continue.<\/p>\n Enable Enable User Database<\/strong> option and enter the parameters<\/strong> set during the database creation.<\/p>\n Click Next<\/strong>.<\/p>\n If no errors are shown click Next<\/strong> to continue.<\/p>\n Create the Admin user<\/strong> typing the username and password then click Next<\/strong>.<\/p>\n Choose as Source Type<\/strong> the MYSQL Native<\/strong><\/span> value and enter the parameter of the database previously created. Click Next<\/strong>. Pay attention to the field Database Tablename<\/strong> where the value must be:<\/p>\n \u00a0SystemEvents<\/span><\/p><\/blockquote>\n Click Finish<\/strong> to complete the installation.<\/p>\n To login to LogAnalyzer you need to enter your credential<\/strong> then click Login<\/strong>.<\/p>\n The Rsyslog server shows the so far collected data<\/strong>. You need to set the network devices to send syslog messages<\/strong> to the Rsyslog server just configured to populate the Events.<\/p>\n <\/p>\n After login you may receive the error message:<\/p>\n could not find the configured table, maybe misspelled or the table names are case sensitive<\/p><\/blockquote>\n This error is often due to wrong syntax<\/strong> in the DBTableName field. To fix it you need to edit the \/var\/www\/html\/loganalyzer\/config.php file and check if the DBTableName<\/strong> value is written with the correct capital letters.<\/p>\n SystemEvents<\/p><\/blockquote>\n # vi \/var\/www\/html\/loganalyzer\/config.php<\/span><\/p>\n Amended<\/strong> the DBTableName value, the system should work properly.<\/p>\n Rsyslog and LogAnalyzerare tools that help administrators to collect the systems log in a centralized place and facilitates the data analysis. In large networks the number of devices installed provides tons of logs that make impossible to have a good overview\u00a0of the overall network status without having a centralized log collector system.<\/p>\n","protected":false},"author":3,"featured_media":7268,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"linkedin_93tdZWzMZc_93tdZWzMZc":"","facebook_2879994398731222_17841400390232720":"","twitter_113568041_113568041":"","mastodon_115463926174894442_115463926174894442":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[899,898],"tags":[634,645],"class_list":["post-7292","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-analysis-en","category-monitoring-en","tag-monitoring-en","tag-syslog-en","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/7292","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=7292"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/7292\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/7268"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=7292"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=7292"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=7292"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Prerequisites<\/h2>\n
\n
Install Rsyslog<\/h2>\n
![\"syslog02\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog02.jpg\" "\\"syslog02\\"")
<\/p>\n![\"syslog03\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog03.jpg\" "\\"syslog03\\"")
<\/p>\nmysql> GRANT ALL PRIVILEGES ON rsyslogdb.* TO rsyslog@localhost IDENTIFIED BY 'passwd00';\r\nmysql> flush privileges;\r\nmysql> exit<\/pre>\n
![\"syslog04\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog04.jpg\" "\\"syslog04\\"")
\nEdit the configuration file \/etc\/rsyslog.conf<\/em> and enable the listed parameters<\/strong>.<\/p>\n$ModLoad imklog\r\n#$ModLoad immark\r\n$ModLoad imudp\r\n$UDPServerRun 514\r\n$ModLoad imtcp\r\n$InputTCPServerRun 514\r\n$ModLoad ommysql<\/pre>\n
![\"syslog05\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog05.jpg\" "\\"syslog05\\"")
<\/p>\n$AllowedSender UDP, 127.0.0.1, 192.168.10.0\/24\r\n$AllowedSender TCP, 127.0.0.1, 192.168.10.0\/24\r\n*.* : ommysql:127.0.0.1,rsyslogdb,rsyslog,passwd00<\/pre>\n
![\"syslog06\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog06.jpg\" "\\"syslog06\\"")
<\/p>\n
\n# service rsyslog restart<\/span><\/p>\n![\"syslog07\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog07.jpg\" "\\"syslog07\\"")
<\/p>\nTest Rsyslog<\/h4>\n
mysql> use rsyslogdb;\r\nmysql> select * from SystemEvents;<\/pre>\n
![\"syslog08\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog08.jpg\" "\\"syslog08\\"")
<\/p>\nInstall LogAnalyzer<\/h2>\n
![\"syslog09\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog09.jpg\" "\\"syslog09\\"")
<\/p>\n
\n<\/span># mv loganalyzer-3.6.3\/src\/ \/var\/www\/html\/loganalyzer<\/span>
\n# mv loganalyzer-3.6.3\/contrib\/* \/var\/www\/html\/loganalyzer<\/span><\/p>\n![\"syslog10\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog10.jpg\" "\\"syslog10\\"")
<\/p>\n
\n<\/span># chmod 744 configure.sh secure.sh<\/span>
\n# .\/configure.sh<\/span><\/p>\n![\"syslog11\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog11.jpg\" "\\"syslog11\\"")
<\/p>\nConfigure LogAnalyzer<\/h4>\n
![\"syslog13\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog13.jpg\" "\\"syslog13\\"")
<\/p>\n![\"syslog14\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog14.jpg\" "\\"syslog14\\"")
<\/p>\n![\"syslog15\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog15.jpg\" "\\"syslog15\\"")
<\/p>\n![\"syslog16\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog16.jpg\" "\\"syslog16\\"")
<\/p>\n![\"syslog17\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog17.jpg\" "\\"syslog17\\"")
<\/p>\n![\"syslog18\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog18.jpg\" "\\"syslog18\\"")
<\/p>\n![\"syslog19\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog19.jpg\" "\\"syslog19\\"")
<\/p>\n![\"syslog20\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog20.jpg\" "\\"syslog20\\"")
<\/p>\n![\"syslog21\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog21.jpg\" "\\"syslog21\\"")
<\/p>\n![\"syslog22\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog22.jpg\" "\\"syslog22\\"")
<\/p>\n![\"syslog25\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog25.jpg\" "\\"syslog25\\"")
<\/p>\nTroubleshooting<\/h2>\n
![\"syslog23\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog23.jpg\" "\\"syslog23\\"")
<\/p>\n![\"syslog24\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2013\/07\/syslog24.jpg\" "\\"syslog24\\"")
<\/p>\n![\"\"](\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/images\/firma.jpg\" "\\"\\"")
<\/p>\n","protected":false},"excerpt":{"rendered":"