1、准备虚拟机，centos6、centso7、centos5;
2、将centos7设置成日志服务器端，将centos6设置为日志服务客户端；
3、从centos5虚拟机使用ssh连接centos6生成、/var/log/secure日志文件；
4、将生成的日志文件转送到centos7服务器端；
1、最小化安装，安装所需要的安装包；
#yum install openssh
centos6、centos7日志配置文件为---/etc/rsyslog.conf
安装包为rsyslog;
centos5日志配置文件---/etc/syslog.conf
安装包为sysklogd(centos5及之前版本)
同步服务器时间；
ntpdate 172.16.0.1
2、查看配置文件；
/etc/ssh
[root@centos7 ~]#cat /etc/ssh/sshd_config |grep -v "^#"|grep -v "^$"
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
（SyslogFacility AUTHPRIV -----生成日志文件类型，发送到日志）
AuthorizedKeysFile .ssh/authorized_keys
PasswordAuthentication yes
ChallengeResponseAuthentication no
GSSAPIAuthentication yes
GSSAPICleanupCredentials no
UsePAM yes
X11Forwarding yes
UsePrivilegeSeparation sandbox # Default for new installations.
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
Subsystem sftp /usr/libexec/openssh/sftp-server
/etc/rsyslog.conf
日志文件类型及日志文件
[root@centos6 ~]#cat /etc/rsyslog.conf |grep -v "^#"|grep -v "^$"
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none /var/log/messages
（authpriv.*） /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg *
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
centos5使用ssh连接centos6,查看生成的日志记录；
[root@station1 ~]#ssh 192.168.226.134
root@192.168.226.134's password:
Last login: Thu Aug 10 21:23:23 2017 from 192.168.226.1
[root@centos6 ~]#
[root@centos6 ssh]#tail /var/log/secure -f
Aug 10 21:22:50 centos6 sshd[3128]: Accepted password for root from 192.168.226.135 port 34327 ssh2
Aug 10 21:22:50 centos6 sshd[3128]: pam_unix(sshd:session): session opened for user root by (uid=0)
Aug 10 21:23:23 centos6 sshd[3148]: Accepted password for root from 192.168.226.1 port 7141 ssh2
Aug 10 21:23:23 centos6 sshd[3148]: pam_unix(sshd:session): session opened for user root by (uid=0)
Aug 10 21:25:41 centos6 sshd[3128]: pam_unix(sshd:session): session closed for user root
Aug 10 21:26:58 centos6 sshd[3202]: Accepted password for root from 192.168.226.135 port 54649 ssh2
Aug 10 21:26:58 centos6 sshd[3202]: pam_unix(sshd:session): session opened for user root by (uid=0)
3、修改配置文件；
在配置文件里开启客户端centos6，514端口；
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514
传送到日志服务器；开启UDP模块时，@IP。开启TCP模块时，@@IP.
authpriv.* @192.168.226.133
4、centos5使用ssh连接centos6；
centos5虚拟机
[root@station1 ~]#ssh 192.168.226.134
root@192.168.226.134's password:
Last login: Thu Aug 10 23:12:00 2017 from 192.168.226.134
[root@centos6 ~]#
centos6虚拟机
[root@centos6 ssh]#tail /var/log/secure -f
Aug 9 13:28:13 centos6 unix_chkpwd[3111]: password check failed for user (root)
Aug 9 13:28:13 centos6 sshd[3105]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.226.135 user=root
Aug 9 13:28:16 centos6 sshd[3105]: Failed password for root from 192.168.226.135 port 36336 ssh2
Aug 10 21:22:50 centos6 sshd[3128]: Accepted password for root from 192.168.226.135 port 34327 ssh2
Aug 10 21:22:50 centos6 sshd[3128]: pam_unix(sshd:session): session opened for user root by (uid=0)
Aug 10 21:23:23 centos6 sshd[3148]: Accepted password for root from 192.168.226.1 port 7141 ssh2
Aug 10 21:23:23 centos6 sshd[3148]: pam_unix(sshd:session): session opened for user root by (uid=0)
Aug 10 21:25:41 centos6 sshd[3128]: pam_unix(sshd:session): session closed for user root
Aug 10 21:26:58 centos6 sshd[3202]: Accepted password for root from 192.168.226.135 port 54649 ssh2
Aug 10 21:26:58 centos6 sshd[3202]: pam_unix(sshd:session): session opened for user root by (uid=0)
centos7虚拟机
[root@centos7 ~]#tail /var/log/secure -f
Aug 10 19:26:00 centos7 useradd[3851]: new user: name=nfsnobody, UID=65534, GID=65534, home=/var/lib/nfs, shell=/sbin/nologin
Aug 10 23:06:34 centos6 sshd[3469]: Accepted password for root from 192.168.226.134 port 49146 ssh2
Aug 10 23:06:34 centos6 sshd[3469]: pam_unix(sshd:session): session opened for user root by (uid=0)
Aug 10 23:11:29 centos6 sshd[3469]: Received disconnect from 192.168.226.134: 11: disconnected by user
Aug 10 23:11:29 centos6 sshd[3469]: pam_unix(sshd:session): session closed for user root
Aug 10 23:12:00 centos6 sshd[3525]: Accepted password for root from 192.168.226.134 port 49148 ssh2
Aug 10 23:12:00 centos6 sshd[3525]: pam_unix(sshd:session): session opened for user root by (uid=0)
Aug 10 23:12:30 centos6 sshd[3525]: Received disconnect from 192.168.226.134: 11: disconnected by user
Aug 10 23:12:30 centos6 sshd[3525]: pam_unix(sshd:session): session closed for user root
Aug 10 23:13:18 centos6 sshd[3202]: pam_unix(sshd:session): session closed for user root
Aug 10 23:14:09 centos6 sshd[3547]: Accepted password for root from 192.168.226.135 port 46989 ssh2
Aug 10 23:14:09 centos6 sshd[3547]: pam_unix(sshd:session): session opened for user root by (uid=0)
centos6上的SECURE日志文件将传送到centos7上的/var/log/secure;
日志文件不会留在centos6上，传送到centos7日志服务器上。
日志相关内容
facility ：设施，从功能或程序上对日志进行 归 类
auth, authpriv, cron, daemon,ftp,kern, lpr, mail,
news, security(auth), user, uucp, local0-local7, syslog
Priority 优先级别，从低到高排序
debug, info, notice, warn(warning), err(error),
crit(critical), alert, emerg(panic）
配置文件：/etc/rsyslog.conf ，/etc/rsyslog.d/*.con
配置文件格式：由三部分组成
MODULES ：相关模块配置
GLOBAL DIRECTIVES ：全局配置
RULES
RULES 配置格式： facility.priority; facility.priority… target
facility： ：
*: 所有的facility
facility1,facility2,facility3,... ：指定的facility 列表
priority： ：
*: 所有级别
none ：没有级别，即不记录
PRIORITY ：指定级别（含）以上的所有级别
=PRIORITY ：仅记录指定级别的日志信息
target： ：
文件路径：通常在/var/log/ ，文件路径前的- 表示异步写入
用户：将日志事件通知给指定的用户，* 表示登录的所有用户
日志服务器：@host ，把日志送往至指定的远程服务器记录
： 管道： | COMMAND
其它的日志文件
/var/log/secure ：系统安装日志，文本格式，应周期性分析
/var/log/btmp ：当前系统上，用户的失败尝试登录相关的日
志信息，二进制格式，lastb 命令进行查看
/var/log/wtmp ：当前系统上，用户正常登录系统的相关日志
信息， 二进制格式， ，last 命令可以查看
/var/log/lastlog: 每一个用户最近一次的登录 信息， 二进制格
式， ，lastlog 命令 可以查看
/var/log/dmesg ：系统引导过程中的日志信息，文本格式
文本查看工具查看
专用命令dmesg 查看
/var/log/messages ：系统中大部分的信息
/var/log/anaconda : anaconda的日志；
rsyslog 将日志记录于MySQL中;
(1) 准备MySQL Server
(2) 在mysql server 上授权rsyslog 能连接至当前服务器
mysql> GRANT ALL ON Syslog.* TO 'USER'@'HOST'
IDENTIFIED BY 'PASSWORD';
(3) 在rsyslog 服务器上安装mysql 模块相关的程序包
yum install rsyslog-mysql
(4) 为rsyslog 创建数据库及表；
mysql -uUSERNAME -hHOST -pPASSWORD <
/usr/share/doc/rsyslog-7.4.7/mysql-createDB.sql
(5) 配置rsyslog 将日志保存到mysql中 中
#### MODULES ####
$ModLoad ommysql
#### RULES ####
facility.priority :ommysql:DBHOST,DBNAME,DBUSER, PASSWORD
通过loganalyzer 展示数据库中的日志;
(1) 在rsyslog 服务器上准备amp 或nmp 组合
yum install httpd php php-mysql php-gd
(2) 安装LogAnalyzer
tar xf loganalyzer-3.6.5.tar.gz
cp -a loganalyzer-3.6.5/src
/var/www/html/loganalyzer
cd /var/www/html/loganalyzer
touch config.php
chmod 666 config.php
