公司使用CactiEz做为网络监控平台，可以实时监控网络设备及出口流量外加邮件报警，虽然有一个延迟但基本够用。除此之外，还需要一个日志服务器。因为设备比较多，设备如果断电重启，问题排除还需借助日志。
华为交换机端配置如下：
info-center source default channel 2 log level warning #日志级别，设置为warning警告最为合适
info-center loghost source Vlanif1101 # 源vlan
info-center loghost 192.168.2.2 #syslog服务器地址
CentOS6.8环境下安装rsyslog 与loganalezer日志分析工具
1、做本地源、yum安装相应包、关闭防火墙、安装http
# 做本地yum源
[root@localhost yum.repos.d]# mv *.repo back/
vim /etc/yum.repos.d/media.repo
[media]
name=media
baseurl=file:///media
enabled=1
gpgcheck=0
# 更新本地源
yum clean all
yum makecache
yum repolist
# 关闭Selinux，修改配置文件；关闭iptables
[root@localhost yum.repos.d]# vim/etc/selinux/config
SELINUX=disabled
[root@localhost yum.repos.d]# getenforce
Enforcing
[root@localhost yum.repos.d]# setenforce 0
[root@localhost yum.repos.d]# getenforce
Permissive
[root@localhost yum.repos.d]#services iptables stop
[root@localhost yum.repos.d]# chkconfig iptables off
# 安装软件包
yum install mysql-server mysql-devel libcurl-devel net-snmp-devel php php-gd php-xml php-mysql httpd –y
# 检查相关包
[root@bogon html]# rpm -qa | grep rsyslog
|rsyslog-gssapi-5.8.10-10.el6_6.x86_64
rsyslog-mysql-5.8.10-10.el6_6.x86_64
rsyslog-relp-5.8.10-10.el6_6.x86_64
rsyslog-pgsql-5.8.10-10.el6_6.x86_64
rsyslog-gnutls-5.8.10-10.el6_6.x86_64
rsyslog-5.8.10-10.el6_6.x86_64
# 启动http
[root@localhost yum.repos.d]#/etc/init.d/httpd start
[root@localhost yum.repos.d]#chkconfig httpd on
正在启动 httpd：httpd: Could not reliably determine the server's fully qualifieddomain name, using localhost.localdomain for ServerName
#测试http运行环境
[root@localhost yum.repos.d] cd /var/www/html/
[root@TS html]# cat > index.php <<EOF
> <?php
> phpinfo();
> ?>
> EOF
打开浏览器打开浏览器访问：
#启动数据库
[root@localhost yum.repos.d]#/etc/init.d/mysqld start
[root@localhost yum.repos.d]#chkconfig mysqld on
#设置mysql密码，查看数据库表
[root@bogon html]# cd /usr/share/doc/rsyslog-mysql-5.8.10/
[root@bogon rsyslog-mysql-5.8.10]# mysql -uroot -pqaz,123 < createDB.sql
[root@bogon ~]# mysql -uroot -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 4
Server version: 5.1.73 Source distribution
Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| Syslog |
| mysql |
| test |
+--------------------+
4 rows in set (0.00 sec)
mysql> use Syslog
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Database changed
mysql> show tables;
+------------------------+
| Tables_in_Syslog |
+------------------------+
| SystemEvents |
| SystemEventsProperties |
+------------------------+
2 rows in set (0.00 sec)
# 授权rsyslog往里读写权限并提交更改
mysql> grant all on Syslog.* to rsyslog@localhost identified by 'adminqaz';
Query OK, 0 rows affected (0.00 sec)
mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)
mysql> exit
Bye
# 修改rsyslog配置文件，开启UDP端口；并使用mysql与rsyslog相关联，
[root@bogon ~]# vim /etc/rsyslog.conf
#新增下面两行
$ModLoad ommysql
*.* :ommysql:localhost,Syslog,rsyslog,adminqaz
说明：localhost 表示本地主机，Syslog 为数据库名，rsyslog 为数据库的用户，adminqaz为该用户密码。
#开启相关模块
# vi /etc/rsyslog.conf
$ModLoad immark #immark是模块名，支持日志标记
$ModLoad imudp #imupd是模块名，支持udp协议
$UDPServerRun 514 #允许514端口日志
# 重启rsyslog服务
/etc/init.d/rsyslog restart
如果正常的话，/var/log/messages下可以接收服务器、交换机的配置信息。
Rsyslog+MySQL+Loganalyzer搭建日志服务器
Rsyslog+MySQL+Loganalyzer搭建日志服务器