Total Hit Counter

Thursday, January 16, 2014

Syslog-ng Configuration to Send logs to Syslog server

Client IP:192.168.1.65
ServerIP:192.168.1.64

Client side add following lines into /etc/syslog-ng/syslog-ng.conf
##########################

source s_local { internal(); unix-stream("/dev/log"); file("/proc/kmsg" program_override("kernel: ")); };
source s_msg { file("/var/log/messages.myhost"); };
destination d_loghost {tcp("192.168.1.64" port(514));};
log { source(s_local); source(s_msg); destination(d_loghost); };

###################################

Server side add following lines
To send logs to mysql need following packages
 libdbi0, libdbi0-dev, libdbd-mysql
##################################

  options {
        flush_lines (0);
    log_fifo_size (2048);
    create_dirs (yes);
    group (shankar);
    dir_group (shankar);
    perm (0640);
    dir_perm (0750);
    };


source s_remote { tcp(); };
destination d_clients { file("/var/log/HOSTS/$HOST/shankar.txt"); };
log { source(s_remote); destination(d_clients); };

# CREATES TABLE IF NOT IN MYSQL

destination d_sql {
sql(type(mysql)
host("localhost") username("root") password("") port("3306")
database("syslog")
table("messages_${HOST}_${R_YEAR}${R_MONTH}${R_DAY}")
columns("datetime", "host", "program", "pid", "message")
values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSGONLY")
indexes("datetime", "host", "program", "pid", "message"));
};


# TO SEND LOGS IN MYSQL
log { source(s_remote); destination(d_sql); };

###################################

No comments: