Syslog-NG Installation - Revision history

DrModiford: oops, wrong category name

2008-06-09T21:27:02Z

oops, wrong category name

DrModiford: Added to categories

2008-06-09T21:26:22Z

Added to categories

DrModiford: Further updates regarding the pipe and mkfifo command

2008-06-09T21:08:05Z

Further updates regarding the pipe and mkfifo command

DrModiford: Removed further old-pipe method

2008-06-09T20:43:09Z

Removed further old-pipe method

DrModiford: Further updates

2008-06-09T20:35:56Z

Further updates

DrModiford: Further removal of the pipe method

2008-06-09T20:24:52Z

Further removal of the pipe method

DrModiford: Removed the old pipe method

2008-06-09T20:18:44Z

Removed the old pipe method

DrModiford: Highlighted the account details in the Pipe section

2008-06-09T14:02:02Z

Highlighted the account details in the Pipe section

DrModiford: Changed the Pipe section with regards to the Gentoo example found (see See Also)

2008-06-09T13:59:15Z

Changed the Pipe section with regards to the Gentoo example found (see See Also)

DrModiford: (...and broke the formatting!)

2008-06-09T13:01:14Z

(...and broke the formatting!)

← Older revision		Revision as of 21:27, 9 June 2008
Line 489:		Line 489:

	[[Category:FreeBSD for Servers]]		[[Category:FreeBSD for Servers]]
−	[[Category:FreeBSD ~~Installation~~]]	+	[[Category:Configuring FreeBSD]]

← Older revision		Revision as of 21:26, 9 June 2008
Line 487:		Line 487:

	There is an equivalent guide for Gentoo users available from the [http://gentoo-wiki.com/HOWTO_setup_PHP-Syslog-NG Gentoo Wiki].		There is an equivalent guide for Gentoo users available from the [http://gentoo-wiki.com/HOWTO_setup_PHP-Syslog-NG Gentoo Wiki].
		+
		+	[[Category:FreeBSD for Servers]]
		+	[[Category:FreeBSD Installation]]

@@ Line 403: / Line 403: @@
 === Syslog-NG Piping ===
-The key component to joining the Syslog-NG service to the MySQL database store is a file-system pipe that buffers events between the two.  This is configured in the Syslog-NG configuration file and the user account and password specified must be added to the MySQL server with permission to ''insert'' and ''select'' records.  The following illustrates how to add the user 'logger' with the password 'l0gg3r'.
+The key component to joining the Syslog-NG service to the MySQL database store is a file-system pipe that buffers events between the two.  This is created with the 'mkfifo' command as follows:
   # mysql -u root -p

@@ Line 113: / Line 113: @@
 === Syslog-NG ===
-In order for Syslog-NG to be aware of what it should log and to where a configuration file must be defined.  The configuration is stored under the '/usr/local/etc/syslog-ng' sub-directory.  An example called 'syslog-ng.conf.sample' exists and it can simply be copied as 'syslog-ng.conf' to enable Syslog-NG to operate in the same way the default Syslog service would have done.  The following is a cut-down version of this file with changes highlighted in '''bold type''' to enable network Syslog capability through to the pipe function (which eventually ends up in the PHP-Syslog-NG / MySQL database):
+In order for Syslog-NG to be aware of what it should log and to where a configuration file must be defined.  The configuration is stored under the '/usr/local/etc/syslog-ng' sub-directory.  An example called 'syslog-ng.conf.sample' exists and it can simply be copied as 'syslog-ng.conf' to enable Syslog-NG to operate in the same way the default Syslog service would have done.  The following is a cut-down version of this file with changes highlighted in '''bold type''' to enable network Syslog capability through to the file system pipe function (which eventually ends up in the PHP-Syslog-NG / MySQL database):
+  #
@@ Line 304: / Line 304: @@
   '''log { source(netsrc); destination(netsql); };'''
-The majority of the above replicates the original Syslog functionality.  The additions send any Syslog events originating from the network to the file-system pipe function.  This is subsequently moved from the the pipe to MySQL via another service script.
+The majority of the above replicates the original Syslog functionality.  The additions send any Syslog events originating from the network to the file-system pipe function which is a form of buffer that passes events onto the MySQL server.
 '''Note:''' for those using smaller displays be aware that some of the above configuration details run off to one side of the page.

@@ Line 443: / Line 443: @@
 Providing 'syslog-ng' is revealed in the list it is safe to assume the upgrade has worked.
-The command 'logger' can generate Syslog type events for testing Syslog (and therefore Syslog-NG) services.  The following example shows how this can be tested.
+The command 'logger' can generate Syslog type events for testing Syslog (and therefore Syslog-NG) services.  The following example shows how this can be tested from the local server:
   # logger -p auth.error '''"Does it work?"'''
@@ Line 454: / Line 454: @@
   Jun  6 21:04:51 servername username : '''Does it work?'''
-This generates an event to the 'auth' logger with level of 'error' using the test notification of 'Does it work?'.  This is captured by the Syslog-NG service and directed to the '/var/log/auth.log' log file.  The Syslog-NG configuration is set to emulate what the original Syslog service but any Syslog events that arrive via the network will be sent to the MySQL pipe service and redirected to the PHP-Syslog-NG database.
+This generates an event to the 'auth' logger with level of 'error' using the test notification of 'Does it work?'.  This is captured by the Syslog-NG service and directed to the '/var/log/auth.log' log file.  The Syslog-NG configuration is set to emulate what the original Syslog service but any Syslog events that arrive via the network will be sent to the PHP-Syslog-NG database using the file system pipe method.
 The majority of intelligent network devices and other Syslog-aware servers and services can utilise a remote Syslog server to send event notifications.  This is particularly true of CISCO devices using up-to-date IOS operating firmware.  An example of the required configuration is as follows:
@@ Line 466: / Line 466: @@
 This configures IOS to log the level 'debugging' and up (which means all events) to the Syslog server on IP address 10.1.6.161.
-Typically configuring the terminal and logging into the console of a CISCO device will usually generate an event which should be logged into the MySQL PHP-Syslog-NG table.  Logging into the PHP-Syslog-NG web-utility should reveal some events.
+Typically making configuring changes on a CISCO device (and even logging into the console on higher-end models) will usually generate an event which is logged into the MySQL PHP-Syslog-NG database using Syslog-NG.  Logging into the PHP-Syslog-NG web-utility should reveal any logged events.
-If CISCO equipment is not being used then another Unix system can be used to generate some test results.  Again, the 'logger' command is used as follows (from a remote server):
+If CISCO equipment is not being used then another Unix system can be used to generate some test results.  Again, the 'logger' command is used as follows from a remote server:
   # logger -h servername -p local0.notice "Hello World"
-'''Note:''' when new remote Syslog events are sent to the Syslog-NG server it is sometimes required that the 'Reload Cache' option needs to be selected from the 'Config' page of PHP-Syslog-NG web page in order to be selectable.
+'''Note:''' when remote Syslog events are received by the Syslog-NG server from a new device or system the PHP-Syslog-NG web-utility may need refreshing.  This is particularly required in order for them to be listed in the Search filter page.  To do so select the 'Reload Cache' option from the 'Config' page of PHP-Syslog-NG.
 == Feedback ==

@@ Line 423: / Line 423: @@
   # cd /usr/local/etc/rc.d
-  # mv mysql-server 030.mysql-server
+  # mv mysql-server 010.mysql-server
-  # mv syslog-ng 050.syslog-ng
+  # mv syslog-ng 020.syslog-ng
-The script '040.syslog-pipe' that starts between these services was created previously.
+This ensures that MySQL server is running before the Syslog-NG process begins piping requests to it.
-This ensures that MySQL server is running before the Syslog Pipe process begins piping requests from the Syslog-NG service.
+While Unix is well known for never requiring a reboot, the number of changes made to the system make it worth doing.
-−
 While Unix is well known for never requiring a reboot, the number of changes made make it worth doing.
   # reboot       (simple as that!)
 == Testing ==

@@ Line 59: / Line 59: @@
   mysql_enable="YES"
   apache22_enable="YES"
 === MySQL ===
@@ Line 75: / Line 72: @@
 This has the effect of moving the physical 'mysql' database store from the default '/var' volume to the larger '/svr' volume and then creates a symbolic link to the original location.  This 'trick' allows MySQL to function without needing to re-configure all of its data store locations individually.  For more information on the concepts of symbolic links review [[ln|this article]].
 If the MySQL directory does not exist first enable it (see above 'rc.conf' entries) and start MySQL as follows:

← Older revision		Revision as of 14:02, 9 June 2008
Line 312:		Line 312:

	'''Note:''' for those using smaller displays be aware that some of the above configuration details run off to one side of the page.		'''Note:''' for those using smaller displays be aware that some of the above configuration details run off to one side of the page.
		+
		+	The above contains the user account 'logger' and password 'l0gg3r' which is must be added as an account on MySQL. This is documented in the 'MySQL Piping' section below.

	=== Apache ===		=== Apache ===

@@ Line 406: / Line 406: @@
 === Syslog-NG Piping ===
-The key component to joining the Syslog-NG service to the MySQL database store are a few scripts that continuously runs in the background.
+The key component to joining the Syslog-NG service to the MySQL database store is a file-system pipe that buffers events between the two.  This is configured in the Syslog-NG configuration file and the user account and password specified must be added to the MySQL server with permission to ''insert'' and ''select'' records.  The following illustrates how to add the user 'logger' with the password 'l0gg3r'.
-−
-This script is called '040.syslog-pipe' and is saved in '/usr/local/etc/rc.d' containing the following:
-−
- #!/bin/sh
-−
- # PROVIDE: syslog_pipe
- # REQUIRE: DAEMON
- # BEFORE:  LOGIN
- # KEYWORD: nojail
-−
- # Code based on documentation found at:
- # http://www.freebsd.org/doc/en_US.ISO8859-1/articles/rc-scripting/rcng-daemon-adv.html
-−
- # Written by DrModiford, www.modiford.com
-−
- .  /etc/rc.subr
-−
- name="syslog_pipe"
- rcvar=`set_rcvar`
-−
- command="/usr/local/bin/mysql"
- command_args="-u logger --password=l0gg3r syslog < /var/log/mysql.pipe 2>&1 &"
-−
- pidfile="/var/run/${name}.pid"
-−
- #load_rc_config $name
- start_precmd="${name}_precmd"
- stop_postcmd="echo Stopped ${name}."
-−
- #command="exec /usr/local/bin/syslog-pipe.sh 2>&1 &"
- #command_interpreter="/bin/sh"
-−
- syslog_pipe_precmd()
-−
- if [ ! -e /var/log/mysql.pipe ]
- then
-         mkfifo /var/log/mysql.pipe
- fi
- return 0
-−
-−
- load_rc_config $name
- run_rc_command "$1"
-−
-This script is called 'syslog-pipe.sh' and is saved in '/usr/local/bin/' containing the following:
-−
- #!/bin/sh
-−
- # Loop MySQL pipe function
- while true
- while [ -e /var/log/mysql.pipe ]
-  do
-         /usr/local/bin/mysql -u logger --password=l0gg3r syslog < /var/log/mysql.pipe
- done
- sleep 1
- done
-−
-Ensure the scripts are executable with the following commands:
-−
- # chmod 555 /usr/local/etc/rc.d/040.syslog-pipe
- # chmod 555 /usr/local/bin/syslog-pipe.sh
-−
-The above contains the user name 'logger' and the password 'l0gg3r' which must be granted access to the syslog database on MySQL.  This is done using the following commands:
   # mysql -u root -p

@@ Line 166: / Line 166: @@
   # CISCO Destinations...
   destination netlog { file("/var/log/network/$HOST/$YEAR$MONTH$DAY.log" owner(root) group(wheel) perm(0644) create_dirs(yes)); };
-−
   '''destination netsql'''
   '''                {'''
@@ Line 174: / Line 174: @@
   '''                template_escape(yes));'''
   '''                };'''
-−
-−
+  #
   # log facility filters