Çàìåíÿåì ñòàíäàðòíûé syslogd íà syslog-ng

[AlexBar]

ïðîñòî î÷èñòêà - íå èíòåðåñíî :-) ïîïîçæå âûëîæó êàê íàñòðîèë

íå çàáóäü òîëüêî âûëîæèòü

[sauron093]

âûíåñ â îòäåëüíóþ òåìó http://wl500g.info/showthread.php?t=15834 ìîæåò êîìó ïðèãîäèòñÿ

[sauron093]

íåñêîëüêî ïåðåðàáîòàë èíñòðóêöèþ è ñêðèïòû

ïåðâûì äåëîì óñòàíàâëèâàåì syslog-ng

ipkg update
ipkg install syslog-ng

ïîñëå óñòàíîâêè çàìåíÿåì èëè èñïðàâëÿåì ôàéë çàïóñêà

/opt/etc/init.d/S01syslog-ng

íà ñëåäóùåå:

#!/bin/sh
#
# Startup script for syslog-ng
#

# Stop syslogd if running
if [ -n "`pidof syslogd`" ]; then
    killall syslogd 2>/dev/null
    sleep 1
fi

if [ -n "`pidof klogd`" ]; then
    killall klogd 2>/dev/null
    sleep 1

    # copy content of original syslogd to new syslog.
    cat /tmp/syslog.log >> /opt/var/log/syslog-ng.log
    # remove old syslog.log
    rm /tmp/syslog.log

    ln -s /opt/var/log/syslog-ng.log /tmp/syslog.log

fi
	
# Stop itself if running
if [ -n "`pidof syslog-ng`" ]; then
    killall syslog-ng 2>/dev/null
    sleep 2
fi

/opt/sbin/syslog-ng

ñêðèïò ïðè çàïóñêå óáèâàåò ñòàíäàðòíûé ëîããåð, ïåðåêèäûâàåò ëîã íà âíåøíèé íîñèòåëü.
ñîçäàííûé ñèìëèíê ïîçâîëÿåò âèäåòü ëîã ÷åðåç âåá

çàìåíÿåì ôàéë êîíôèãóðàöèè

/opt/etc/syslog-ng/syslog-ng.conf

íà ñëåäóþùåå:

################################################################################
# Syslog-ng configuration
# /opt/etc/syslog-ng/syslog-ng.conf
#

###############################################################################
# tiwag's active filters and logs
#

options { long_hostnames(off); sync(0); };

source src { file("/proc/kmsg");unix-stream("/dev/log"); internal(); };
source net { udp(); };

destination mysyslog {
    file("/opt/var/log/syslog-ng.log"
	owner("root")
	group("root")
	perm(0640)
	template("$HOUR:$MIN:$SEC $DAY-$MONTH-$YEAR ($PRIORITY|$FACILITY|$PROGRAM) $MESSAGE\n")
    ); 
};
		    
destination authwarnlog { 
    file("/opt/var/log/authwarn.log"
	owner("root")
	group("root")
	perm(0640)
	template("$HOUR:$MIN:$SEC $DAY-$MONTH-$YEAR ($PRIORITY|$FACILITY|$PROGRAM) $MESSAGE\n")
    ); 
};
					
destination vsftpdlog   { file("/opt/var/log/vsftpd.log"
			  template("$HOUR:$MIN:$SEC $DAY-$MONTH-$YEAR ($PRIORITY|$FACILITY|$PROGRAM) $MESSAGE\n")
    );
};
destination dropbearlog { file("/opt/var/log/dropbear.log"
			  template("$HOUR:$MIN:$SEC $DAY-$MONTH-$YEAR ($PRIORITY|$FACILITY|$PROGRAM) $MESSAGE\n")
    );
};
destination cronlog     { file("/opt/var/log/cron.log"
			  template("$HOUR:$MIN:$SEC $DAY-$MONTH-$YEAR ($PRIORITY|$FACILITY|$PROGRAM) $MESSAGE\n")
    );
};
										
filter f_ni_syslog-ng { not ( level(info) and program(syslog-ng) ); };
filter f_ni_thttpd    { not ( level(info) and program(thttpd)    ); };
filter f_ni_vsftpd    { not ( level(info) and program(vsftpd)    ); };
filter f_ni_cron      { not ( (level(notice) and program(cron) ) or ( level(info) and  facility(cron) ) ); };
					
filter f_vsftpd   { ( program(vsftpd)   ); };
filter f_dropbear { ( program(dropbear) ); };
filter f_cron     { ( level(notice) and  program(cron) ); };
filter f_authwarn { ( ( ( level(info) or level(warning) ) and program(dropbear) ) or ( ( level(warning) ) and  program(vsftpd) ) ); };

###############################################################################
# active logs
#

log { source(src); 
    filter(f_ni_vsftpd); 
    filter(f_ni_thttpd); 
    filter(f_ni_syslog-ng); 
    filter(f_ni_cron);
    destination(mysyslog); };

log { source(src); 
    filter(f_vsftpd);   
    destination(vsftpdlog); };

log { source(src); 
    filter(f_dropbear); 
    destination(dropbearlog); };

log { source(src); 
    filter(f_authwarn); 
    destination(authwarnlog); };

log { source(src); 
    filter(f_cron); 
    destination(cronlog); };

ïîñëå ïåðåçàãðóçîê ëîã ñîõðàíÿåòñÿ.
Ñîîòâåòñòâåííî ñèñòåìíûé ëîã íàõîäèòñÿ â /opt/var/log/syslog-ng.log,
îøèáêè àâòîðèçàöèè /opt/var/log/authwarn.log
ïîäêëþ÷åíèÿ ïî ftp /opt/var/log/vsftpd.log
ïîäêëþ÷åíèÿ ïî ssh /opt/var/log/dropbear.log
ëîãè cron`à /opt/var/log/cron.log

äëÿ ïðèâåäåíèÿ ëîãîâ CRONà â ïîðÿäîê, çàìåíÿåì ñêðèïò
/opt/bin/run-parts
íà ñëåäóùåå:

#!/bin/sh
#
# runparts.sh by macsat@macsat.com
# intended for use with cron
#
# based on rc.unslung by unslung guys :-)
#
if [ -z "$1" ]
then
echo "Usage : $0 "
fi

RUNDIR=$1"/*"

for i in $RUNDIR ;do

# Ignore dangling symlinks (if any).
[ ! -f "$i" ] && continue

case "$i" in
*.sh)
# Source shell script for speed.
(
logger -t "$i" "running"
trap - INT QUIT TSTP
set start
. $i
)
;;
*)
# No sh extension, so fork subprocess.
logger -t "$i" "running"
$i start
;;
esac
done

Äëÿ òîãî ÷òîá ëîãè ñèëüíî íå ðàçäóâàëèñü, íàïèñàë ñêðèïò äëÿ àâòîìàòè÷åñêîãî àðõèâèðîâàíèÿ ëþáûõ ëîãîâ, íàõîäÿùèõñÿ â ïàïêå ëîãîâ. Ñêðèïò ïîìåùàåì â ïàïêó åæå÷àñíîãî çàïóñêà CRONa

/opt/etc/cron.hourly/archivelog.sh

#!/bin/sh

log_dir="/opt/var/log"
archive_dir="/opt/var/log/archive"
log_max_size=100  #Kb

sleep 1

for i in $log_dir/* ;do

# Ignore dangling symlinks (if any).
[ ! -f "$i" ] && continue

if (expr $(du $i | sed 's/\/.*//') \> $log_max_size > /dev/null 2>&1) then
    { 
    archive_file=`echo "0" $i | sed 's:^.*/\(.*\):\1:g'`
    archive_file=`date +%Y%m%d%H-$archive_file`
    archive_file="$archive_dir/$archive_file"
    
    cp "$i" "$archive_file"
    printf "Contents of this file are placed in archive $archive_file.gz\n" > $i
    gzip "$archive_file" 
    
    sleep 1
    
    prg=`echo "0" $0 | sed 's:^.*/\(.*\):\1:g'`
    logger -t "$prg" "$i compressed to $archive_file.gz"
    }
fi

done

ñêðèïò ïðîâåðÿåò äèðåêòîðèþ ñ ëîãàìè, åñëè íàõîäèò ëîã ðàçìåðîì áîëåå óêàçàííîãî, òî àðõèâèðóåò åãî â óêàçàííóþ ïàïêó.

ÇÛ:
ÿ ó ñåáÿ ïåðåíàñòðîèë âñå ïðîãðàììû, ÷òîá ëîãè ïèñàëèñü â ïàïêó /opt/var/log/

Íå çàáûâàåì ñäåëàòü ñêðèïòû èñïîëíÿåìûìè:

chmod +x /opt/etc/init.d/S01syslog-ng
chmod +x /opt/etc/cron.hourly/archivelog.sh

è ñîçäàòü äèðåêòîðèþ äëÿ àðõèâîâ

mkdir -p /opt/var/log/archive/

íó è ÷òîá âñå ýòî íà÷àëî ðàáîòàòü:

reboot

[vectorm]

Íå çàáûâàåì äåëàòü:
chmod +x /opt/etc/init.d/S01syslog-ng
chmod +x /opt/etc/cron.hourly/clearlog.sh

è òóò:

/opt/etc/syslog-nd/syslog-nd.conf 

î÷åïÿòêà, íàäî

/opt/etc/syslog-ng/syslog-ng.conf 

[lokypilot]

Ñïàñèáî çà ïîäðîáíî èçëîæåííûå èíñòðóêöèè
Íàäî áóäåò âñå èìåííî òàê è ñäåëàòü

[sauron093]

Íå çàáûâàåì äåëàòü:
chmod +x /opt/etc/init.d/S01syslog-ng
chmod +x /opt/etc/cron.hourly/clearlog.sh

ÿ ïðîñòî âñå äåëàþ ÷åðåç mc, òàì ìûøîé òêíóë 2 ðàçà è àòðèáóò ïîñòàâèë, äàæå íå çàìîð÷èâàþñü, òåì áîëåå îí * ñâåòèò ïåðåä èñïîëíÿåìûì ôàéëîì

è òóò:

/opt/etc/syslog-nd/syslog-nd.conf 

î÷åïÿòêà, íàäî

/opt/etc/syslog-ng/syslog-ng.conf 

î÷åïÿòêó ïîïðàâèë

[vaspupkin]

Óæå ðàáîòàåò

Òîãäà óæ äëÿ çàâåðøåíèÿ ìàíóàëà:
äîáàâèòü â /tmp/local/sbin/post-mount ñòðîêó çàïóñêà

#çàïóñê ëîãa
/opt/etc/init.d/S01syslog-ng

è ñîõðàíèòü

flashfs save
flashfs commit
flashfs enable

[sauron093]

Óæå ðàáîòàåò

Òîãäà óæ äëÿ çàâåðøåíèÿ ìàíóàëà:
äîáàâèòü â /tmp/local/sbin/post-boot ñòðîêó çàïóñêà

#çàïóñê ëîãa
/opt/etc/init.d/S01syslog-ng

ó ìåíÿ àâòîìàòîì âñå ñêðèïòû èç /opt/etc/init.d/ çàïóñêàåò rc.unslung

è â post-boot íåëüçÿ êëàñòü, ò.ê. õàðä åùå íå ñìîíòèðîâàí, à ìû ëîã íà íåãî ïåðåêèäûâàåì

â post-mount äîáàâëÿéòå çàïóñê ñêðèïòà

flashfs save
flashfs commit
flashfs enable

àáñîëþòíî íå íàäà ò.ê. ìû ðàáîòàåì íà õàðäå(ôëåøêå) è âíóòðÿííèé ôëåø íå èñïîëüçóåì

[vaspupkin]

...àáñîëþòíî íå íàäà

Íàäà, åñëè ìû ïðàâèì post-mount è íåò ó íàñ rc.unslung, íî ýòî íå âàæíî... Ñïàñèáî çà ñêðèïò. Î÷ ïîëåçíî!

À âîò ÷òî áû â ëîãå çíà÷èëî PRI:err?

{2008-08-29 01:11:45}{PRI:err}{FAC:daemon}{PRG:nmbd}{{{ nmbd[298]: [2008/08/29 01:11:45, 0] nmbd/nmbd_become_lmb.c:become_local_master_stage2(405) }}}
{2008-08-29 01:11:45}{PRI:err}{FAC:daemon}{PRG:nmbd}{{{ nmbd[298]:   ***** }}}
{2008-08-29 01:11:45}{PRI:err}{FAC:daemon}{PRG:nmbd}{{{ nmbd[298]:    }}}
{2008-08-29 01:11:45}{PRI:err}{FAC:daemon}{PRG:nmbd}{{{ nmbd[298]:   Samba name server WL500W is now a local master browser for workgroup WORKGROUP on subnet 192.168.2.1 }}}

[Lupo_Alberto]

Ïðè óñòàíîâêå syslog-ng âûäàë ñëåäóþùåå:

To use syslog-ng, comment out any lines in /etc/inittab referring
to syslogd or klogd before you start syslog-ng for the first time.
After commenting the lines, run /opt/etc/init.d/S01syslog-ng.
The program will be started automaticaly at the next reboot.

È, êàê ÿ ïîíèìàþ, â íàëè÷èè â ñêðèïòå ïðîâåðêè íà çàïóùåííûé syslogd íåò íåîáõîäèìîñòè.

[sauron093]

êàê ÿ ïîíÿë òî ÷òî PRI ýòî ïðèîðèòåò ñîîáùåíèÿ

[sauron093]

Ïðè óñòàíîâêå syslog-ng âûäàë ñëåäóþùåå:

To use syslog-ng, comment out any lines in /etc/inittab referring
to syslogd or klogd before you start syslog-ng for the first time.
After commenting the lines, run /opt/etc/init.d/S01syslog-ng.
The program will be started automaticaly at the next reboot.

È, êàê ÿ ïîíèìàþ, â íàëè÷èè â ñêðèïòå ïðîâåðêè íà çàïóùåííûé syslogd íåò íåîáõîäèìîñòè.

íó åñëè ó âàñ syslogd íå ñòàðòóåò àâòîìàòîì, ÷òî ñòðàííî, òî âèäèìî íåò

ó ìåíÿ îí ñòàðòóåò è åãî ïðèõîäèòñÿ óáèâàòü êàæäûé ðàç

[Lupo_Alberto]

Èçâèíèòå, ïîòîðîïèëñÿ ñ âûâîäàìè.
Ó ìåíÿ ïî÷åìó-òî ýòîãî ôàéëà è íåò!

[sauron093]

Èçâèíèòå, ïîòîðîïèëñÿ ñ âûâîäàìè.
Ó ìåíÿ ïî÷åìó-òî ýòîãî ôàéëà è íåò!

íó ÿ òîæå äîëãî èñêàë â ðîóòåðå syslogd.conf, à îêàçàëîñü ÷òî åãî íåòó ñîâñåì... syslogd óðåçàí è êîíôèãóðàöèîííûå ôàéëû íå âîñïðèíèìàåò

[sauron093]

Íàäà, åñëè ìû ïðàâèì post-mount è íåò ó íàñ rc.unslung, íî ýòî íå âàæíî... Ñïàñèáî çà ñêðèïò. Î÷ ïîëåçíî!

À âîò ÷òî áû â ëîãå çíà÷èëî PRI:err?

âîò êàê ôîðìèðóåòñÿ ñòðîêà âûâîäà:

template("{$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC}{PRI:$PRIORITY}{FAC:$FACILITY}{PRG:$PROGRAM}{{{ $MESSAGE }}}\n")