Rsyslog+LogAnalyzer日志系统显示源主机和源IP-爱开源

Rsyslog+LogAnalyzer 相信很多朋友都在用，也相信很多朋友遇到主机名问题，比如日志的主机名都是localhost，如下图

这种情况是由于没有设置合理的主机名导致的，还有一种情况主机名相同但是源IP不同，也可能导致无法详细分析日志

一、修改主机名

This is The Text Code

[root@localhost ~]# vi /etc/sysconfig/network
NETWORKING=yes
NETWORKING_IPV6=no
HOSTNAME=syslogParsed in 0.000 seconds at 319.03 KB/s

This is The Text Code

[root@localhost ~]# vi /etc/hosts
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 syslog.selboo.com.cn syslog # 建议放到最上面
127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6Parsed in 0.000 seconds at 1397.61 KB/s

修改完成之后重启 Rsyslog 服务，并查看 /var/log/messages 文件内的localhost是否变为syslog。

二、为LogAnalyzer添加源IP

1、数据库修改

LogAnalyzer 默认表字段只有一个 FromHost，我们在添加一个 FromIP，用于记录源IP地址。

This is The SQL Code

mysql> USE Syslog;
mysql> ALTER TABLE SystemEvents ADD FromIP VARCHAR(60) DEFAULT NULL AFTER FromHost;Parsed in 0.004 seconds at 25.39 KB/s

2、修改rsyslog.conf

rsyslog 默认情况下插入语句没有 FromIP字段，我们修改插入SQL 语句添加 FromIP字段即可,

This is The Text Code

$template insertpl,”insert into SystemEvents (Message, Facility, FromHost, FromIP, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values (‘%msg%’, %syslogfacility%, ‘%HOSTNAME%’, ‘%fromhost-ip%’, %syslogpriority%, ‘%timereported:::date-mysql%’, ‘%timegenerated:::date-mysql%’, %iut%, ‘%syslogtag%’)”,SQL

$ModLoad ommysql
. :ommysql:localhost,Syslog,root,123456;insertpl# 应用上面SQL语句 Parsed in 0.000 seconds at 1343.40 KB/s

3、LogAnalyzer添加源IP地址

添加Fields