使用rsyslog+loganalzey收集日志显示客户端ip

http://www.ituring.com.cn/article/128536

1、数据库修改

LogAnalyzer 默认表字段只有一个 FromHost，我们在添加一个 FromIP，用于记录源IP地址。

mysql> use Syslog;
mysql> alter table SystemEvents add FromIP varchar(60) default null after FromHost; 

2、修改rsyslog.conf

rsyslog 默认情况下插入语句没有 FromIP字段，我们修改插入SQL 语句添加 FromIP字段即可。

$template insertpl,"insert into SystemEvents (Message, Facility, FromHost, FromIP, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', '%fromhost-ip%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL

$ModLoad ommysql 
*.*       :ommysql:localhost,Syslog,rsyslog,syslog;insertpl 

#应用上面SQL语句，template在ModLoad上面

3、LogAnalyzer添加源IP地址

3.1、登录管理后台

使用管理员账号登录

进入Admin Center

3.2、添加Fields

3.3、添加views

3.4添加DBMappings,用于建立字段对应关系

uID => id, Date => devicereportedtime, Host => fromhost, IP => fromip, Messagetype => infounitid, Message => message, Facility => facility, Severity => priority, Syslogtag => syslogtag, ProcessID => processid, Event ID => eventid, Eventlog Type => eventlogtype, Event Source => eventsource, Event Category => eventcategory, Event User => eventuser, SystemID => systemid, Checksum => checksum

注： DBMappings注意大小写，对应后面全部小写，不能有错，对应如下。

uID => id, Date => devicereportedtime, Host => fromhost, Messagetype => infounitid, Message => message, Facility => facility, Severity => priority, Syslogtag => syslogtag, ProcessID => processid, Event ID => eventid, Eventlog Type => eventlogtype, Event Source => eventsource, Event Category => eventcategory, Event User => eventuser, SystemID => systemid, Checksum => checksum

3.5、修改数据源配置

修改默认 Table type =>> MonitorWare, 修改为 SYSLOG_IP。

修改日志选择 Select View => SYSLOG_IP。 

4、效果图