System-NG

# 主程序安装

cd /usr/local/src
#wget http://www.myciscolab.net/sources/eventlog_0.2.12.tar.gz
wget http://www.myciscolab.net/sources/eventlog_0.2.12.tar.gz
tar xzvf eventlog_0.2.12.tar.gz
cd eventlog-0.2.12
./configure
make
make install
export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/

安装syslog-ng
cd /usr/local/src
#lftp -c "pget -n 20 http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.2.4/source/syslog-ng_3.2.4.tar.gz"
#wget http://www.myciscolab.net/sources/syslog-ng_3.2.4.tar.gz
wget http://www.myciscolab.net/sources/syslog-ng-3.2.4.tar.gz
#unzip -d . syslog-ng-3.3.zip
tar xzvf syslog-ng-3.2.4.tar.gz
#cd balabit-syslog-ng-3.3-44587f8
cd syslog-ng-3.2.4
./configure --prefix=/usr/local/syslog-ng-3.2.4
make && sudo make install 


# 安装后配置

# 启动脚本 执行文件 建立目录 链接等
cp /usr/local/src/syslog-ng-3.2.4/contrib/rhel-packaging/syslog-ng.init /etc/init.d/syslog-ng
chmod a+x /etc/init.d/syslog-ng
ln -s /usr/local/syslog-ng-3.2.4 /usr/local/syslog-ng
ln -s /usr/local/syslog-ng/sbin/syslog-ng /sbin/syslog-ng
mkdir /usr/local/syslog-ng/var
chkconfig syslog-ng on
service syslog-ng restart

# 客户端配置

# file: /usr/local/syslog-ng/etc/syslog-ng.conf
@version: 3.1
options { long_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no);
          owner("root"); group("adm"); perm(0640); stats_freq(0);
          bad_hostname("^gconfd$");
};
source test{ file("/var/log/messages" follow_freq(1));};
destination test { syslog("192.168.1.54" transport("tcp") port(555));};
log { source(test); destination(test);};

# 服务端配置

source log51001 {syslog(ip(0.0.0.0) port(51001));};
destination log51001 { file("/logs/1.10/nginx/access.log/${S_YEAR}/${S_MONTH}/access.com.${S_YEAR}${S_MONTH}${S_DAY}.log" template(template_standard)); };
log{source(log51001);destination(log51001);};

# 启动脚本

# syslog-ng启动脚本
#!/bin/bash
#
# syslog-ng     This starts and stops syslog-ng
#
# chkconfig:    2345 12 88
# description:  syslog-ng is an alternative system logger
# processname:  syslog-ng
# pidfile:      /var/run/syslog-ng.pid
### BEGIN INIT INFO
# Provides: $syslog-ng
### END INIT INFO

# Source function library.
. /etc/init.d/functions

binary="/sbin/syslog-ng"

[ -x $binary ] || exit 0

RETVAL=0

start() {
        echo -n "Starting syslog-ng: "
        daemon $binary
        RETVAL=$?
        echo
        [ $RETVAL -eq 0 ] && touch /var/lock/subsys/syslog-ng
}

stop() {
        echo -n "Shutting down syslog-ng: "
        killproc syslog-ng
        RETVAL=$?
        echo
        if [ $RETVAL -eq 0 ]; then
                rm -f /var/lock/subsys/syslog-ng
                rm -f /var/run/syslog-ng.pid
        fi
}

restart() {
        echo -n "Restarting syslog-ng: "
        $binary --syntax-only
        RETVAL=$?
        echo
        if [ $RETVAL -eq 0 ]; then
                stop
                sleep 2
                start
        fi
}

reload() {
        echo -n "Reloading syslog-ng: "
        $binary --syntax-only
        RETVAL=$?
        if [ $RETVAL -eq 0 ]; then
                killproc syslog-ng -1
        fi
}

case "$1" in
        start)
                start
                ;;
        stop)
                stop
                ;;
        status)
                status syslog-ng
                ;;
        restart)
                restart
                ;;
        reload)
                reload
                ;;
        condrestart)
                [ -f /var/lock/subsys/syslog-ng ] && restart
                ;;
        *)
                echo "Usage: $0 {start|stop|status|restart|reload|condrestart}"
                ;;
esac