1、loganalyzer服务器搭建
[root@localhost ~]# getenforce #查看selinux是否关闭
[root@localhost ~]# setenforce 0 #临时关闭;修改配置文件/etc/selinux/config,将其中SELINUX设置为disabled(永久关闭)
[root@localhost ~]# systemctl status firewalld.service
[root@localhost ~]# systemctl stop firewalld.service
[root@localhost ~]# yum install mariadb mariadb-server -y
[root@localhost ~]# systemctl start mariadb.service
[root@localhost ~]# /bin/mysql_secure_installation #初始化mariadb数据库
[root@localhost ~]# yum install rsyslog-mysql -y
[root@localhost ~]# mysql -uroot -proot </usr/share/doc/rsyslog-8.24.0/mysql-createDB.sql
MariaDB [(none)]> grant all privileges on Syslog.* to 'rsyslog'@'%' identified by 'rsyslog';flush privileges;
[root@localhost ~]# vim /etc/rsyslog.d/loganalyzer.conf
$ModLoad ommysql #所有日志 :ommysql:数据库地址,数据库名,登陆数据库的用户,用户密码 *.* :ommysql:localhost,Syslog,rsyslog,rsyslog #使用UDP协议传输 $ModLoad imudp $UDPServerRun 514 $UDPServerRun 38514 #使用TCP协议传输（两者可同时使用） $ModLoad imtcp $InputTCPServerRun 514 $InputTCPServerRun 38514
[root@localhost ~]# systemctl restart rsyslog.service
[root@localhost ~]# yum install httpd php php-mysql php-gd -y
[root@localhost ~]# wget http://download.adiscon.com/loganalyzer/loganalyzer-4.1.7.tar.gz
[root@localhost ~]# cp -a loganalyzer-master/src/* /var/www/html/
[root@localhost ~]# systemctl start httpd.service
[root@docker ~]# vim /var/www/html/hello.php #创建php测试页
<?php phpinfo(); ?>
[root@localhost ~]# touch /var/www/html/config.php
[root@localhost ~]# chmod 666 /var/www/html/config.php
[root@localhost ~]# vim /var/www/html/include/functions_common.php #关闭loganalyzer的资助信息(true改为false)
72 $content['SHOW_DONATEBUTTON'] = false; // Default = true!
2、Web页面配置：
思科交换机日志推送
logging trap informational
logging facility local5 #把日志发送到rsyslog的local5设备
logging host 10.10.10.10
ASA防火墙日志推送
logging enable
logging timestamp
logging trap informational
logging facility 21 #21对应local5
logging host inside 10.10.10.10
3、nginx日志发送到日志服务器
rsyslog服务器配置
[root@rsyslog ~]# grep -vE "^$|#" /etc/rsyslog.conf $ModLoad imudp $UDPServerRun 514 $ModLoad imtcp $InputTCPServerRun 514 $WorkDirectory /var/lib/rsyslog $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $IncludeConfig /etc/rsyslog.d/*.conf $OmitLocalLogging on $IMJournalStateFile imjournal.state *.info;mail.none;authpriv.none;cron.none;local5.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron *.emerg :omusrmsg:* uucp,news.crit /var/log/spooler local7.* /var/log/boot.log $ModLoad ommysql local5.* :ommysql:localhost,Syslog,rsyslog,rsyslog
nginx端rsyslog配置
[root@nginx ~]# grep -vE "^$|^#" /etc/rsyslog.conf $ModLoad imuxsock $ModLoad imklog $ModLoad imudp $UDPServerRun 514 $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $IncludeConfig /etc/rsyslog.d/*.conf *.info;mail.none;authpriv.none;cron.none;local5.none /var/log/messages authpriv.* /var/log/secure mail.* -/var/log/maillog cron.* /var/log/cron *.emerg * uucp,news.crit /var/log/spooler local7.* /var/log/boot.log local5.* @10.10.10.10:514 # @@表示通过tcp协议发送;@表示通过udp协议发送 [root@nginx ~]# cat /etc/rsyslog.d/nginx.conf $ModLoad imfile $InputFileName /application/nginx-1.14.2/logs/web01.log $InputFileTag nginx_1: $InputFileStateFile /application/nginx-1.14.2/logs/pianyi.log $InputFileSeverity info $InputFileFacility local5 $InputRunFileMonitor $InputFilePollInterval 1 $InputFilePersistStateInterval 1 $ActionQueueSaveOnShutdown on
[root@rsyslog]#logger -p local3.info 'KadeFor is testing the rsyslog and logger' #产生一条日志
参考链接：
https://loganalyzer.adiscon.com/downloads/loganalyzer-v4-1-7-v4-stable/
https://blog.51cto.com/11555417/2046796
https://www.cnblogs.com/kevingrace/p/5570411.html
https://blog.51cto.com/zhpfbk/1878901 #Rsyslog实现对Nginx日志发送至日志服务器
https://blog.csdn.net/Scirhh/article/details/83016456 #ELK部署
https://www.cnblogs.com/iamqiu/p/5749783.html #graylog日志监控
https://www.cnblogs.com/liang545621/p/9448402.html #graylog日志监控
来源：https://www.cnblogs.com/xwupiaomiao/p/10456213.html