zoukankan      html  css  js  c++  java
  • 使用rsyslog+loganalzey收集日志显示客户端ip

    http://www.ituring.com.cn/article/128536

    1、数据库修改

    LogAnalyzer 默认表字段只有一个 FromHost,我们在添加一个 FromIP,用于记录源IP地址。

    mysql> use Syslog;
    mysql> alter table SystemEvents add FromIP varchar(60) default null after FromHost; 
    

    2、修改rsyslog.conf

    rsyslog 默认情况下插入语句没有 FromIP字段,我们修改插入SQL 语句添加 FromIP字段即可。

    $template insertpl,"insert into SystemEvents (Message, Facility, FromHost, FromIP, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', '%fromhost-ip%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL
    
    $ModLoad ommysql 
    *.*       :ommysql:localhost,Syslog,rsyslog,syslog;insertpl 
    
    #应用上面SQL语句,template在ModLoad上面

    3、LogAnalyzer添加源IP地址

    3.1、登录管理后台

    使用管理员账号登录

    进入Admin Center

    3.2、添加Fields

    3.3、添加views

    3.4添加DBMappings,用于建立字段对应关系

    uID => id, Date => devicereportedtime, Host => fromhost, IP => fromip, Messagetype => infounitid, Message => message, Facility => facility, Severity => priority, Syslogtag => syslogtag, ProcessID => processid, Event ID => eventid, Eventlog Type => eventlogtype, Event Source => eventsource, Event Category => eventcategory, Event User => eventuser, SystemID => systemid, Checksum => checksum

    注: DBMappings注意大小写,对应后面全部小写,不能有错,对应如下。

    uID => id, Date => devicereportedtime, Host => fromhost, Messagetype => infounitid, Message => message, Facility => facility, Severity => priority, Syslogtag => syslogtag, ProcessID => processid, Event ID => eventid, Eventlog Type => eventlogtype, Event Source => eventsource, Event Category => eventcategory, Event User => eventuser, SystemID => systemid, Checksum => checksum
    

    3.5、修改数据源配置

    修改默认 Table type =>> MonitorWare, 修改为 SYSLOG_IP。

    修改日志选择 Select View => SYSLOG_IP。 

    4、效果图

  • 相关阅读:
    数论 UVA 10943
    数论 UVA 11889
    数论 UVA 11388
    UVA 572
    hdu 1016
    poj 1308
    poj 1363
    java web-----servelet
    java IO文件读写例子(OutputStream,InputStream,Writer,Reader)
    java web环境配置类型问题
  • 原文地址:https://www.cnblogs.com/linkenpark/p/8297302.html
Copyright © 2011-2022 走看看