<\/p>\n
\ubaa9\ud45c : \ubaa8\ub4e0 \uc11c\ubc84\uc758 SYSLOG\ub97c \ub85c\uadf8 \uc11c\ubc84\ub85c \uc3d8\uac8c \ud558\uace0, \ub85c\uadf8\uc11c\ubc84\uc5d0\uc11c\ub294 HOST-yyyymmdd.log \ub97c \ub9cc\ub4e4\uc5b4 \uad00\ub9ac\ud558\ub3c4\ub85d \uc124\uc815.
\nSyslog-NG(Syslog New Generation)\ub294 \ubcf4\ub2e4 \ud5a5\uc0c1\ub41c \ud544\ud130\ub9c1 \ubc0f \ud3ec\uc6cc\ub529 \uae30\ub2a5 \uc678\uc5d0 \uba54\uc2dc\uc9c0 \ubb34\uacb0\uc131\uacfc \uc554\ud638\ud654 \uae30\ub2a5\uc744 \ucd94\uac00\ud558\uc5ec syslog\uc758 \uc720\uc5f0\uc131\uc744 \uc99d\uac00\uc2dc\ucf30\uc73c\uba70, TCP\uc640 UDP \ud504\ub85c\ud1a0\ucf5c\uc744 \ud1b5\ud55c \uc6d0\uaca9 Logging\uc744 \uc9c0\uc6d0\ud569\ub2c8\ub2e4.
\n\uc548\uc815\uc131\uc5d0 \uc788\uc5b4\uc11c\ub3c4 \uc88b\uc740 \ud3c9\uac00\ub97c \ubc1b\uace0 \uc788\uc73c\uba70, \uac8c\ub2e4\uac00 \uace0\uae09 \ubcf4\uc548 \uae30\ub2a5\ub4e4\uc740 \uc544\uc9c1\uae4c\uc9c0\ub3c4 \uc5c5\ub370\uc774\ud2b8\uc911\uc5d0 \uc788\uc9c0\ub9cc, \uc6d0\uaca9\ud638\uc2a4\ud2b8\ub85c\ubd80\ud130 \ubc1b\ub294 \uba54\uc2dc\uc9c0\ub97c \uc778\uc99d\ud558\uace0 \uc554\ud638\ud654\ud558\ub294 \uae30\ub2a5\uc740 SSL Wrapper\uc778 Stunnel\uc640 ssh\uc640 \uac19\uc740 TCP \ud130\ub110\ub9c1 \ub3c4\uad6c\uc640 \ud568\uaed8 \uc0ac\uc6a9\ub420 \uc218\ub3c4 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n
1. libol \uc124\uce58<\/p>\n
]# tar xvzf libol-0.3.18.tar.gz\r\n]# cd libol-0.3.18\r\n]# .\/configure\r\nchecking for cl... no\r\nconfigure: error: no acceptable C compiler found in $PATH\r\nSee `config.log' for more details.\r\n<\/pre>\n\ud5d0.. gcc \uc124\uce58..<\/p>\n
]# yum install gcc<\/pre>\nlibol \uc124\uce58 \uc7ac\uc2dc\ub3c4<\/p>\n
]# .\/configure\r\nchecking how to run the C++ preprocessor... \/lib\/cpp\r\nconfigure: error: C++ preprocessor \"\/lib\/cpp\" fails sanity check\r\nSee `config.log' for more details.\r\n<\/pre>\ngcc-c++, glibc-devel\ub3c4 \uc124\uce58<\/p>\n
]# yum install gcc-c++ glibc-devel<\/pre>\nlibol \uc124\uce58 \uc131\uacf5!!<\/p>\n
]# .\/configure\r\n...\r\n]# make; make install<\/pre>\n2. eventlog \uc124\uce58<\/p>\n
]# tar xvzf eventlog_0.2.12.tar.gz\r\n]# cd eventlog_0.2.12\r\n]# .\/configure\r\n]# make; make install\r\n<\/pre>\n3. libnet \uc124\uce58<\/p>\n
]# wget http:\/\/www.sfr-fresh.com\/unix\/privat\/libnet-1.1.2.1.tar.gz\r\n]# tar xvzf libnet-1.1.6.tar.gz\r\n]# cd libnet-1.1.6\r\n]# .\/configure\r\n]# make; make install<\/pre>\n4. syslog-ng \uc124\uce58<\/p>\n
]# tar xvzf syslog-ng_3.2.4.tar.gz\r\n]# cd syslog-ng-3.2.4\/\r\n]# export PKG_CONFIG_PATH=$PKG_CONFIG_PATH:\/usr\/local\/lib\/pkgconfig\r\n\r\n]# .\/configure --prefix=\/etc\/syslog-ng\r\n...\r\nchecking whether to enable SQL support... no\r\nchecking for GLIB... no\r\nconfigure: error: Package requirements (glib-2.0 >= 2.10.1 gmodule-2.0) were not met:\r\n\r\nNo package 'glib-2.0' found\r\nNo package 'gmodule-2.0' found\r\n\r\nConsider adjusting the PKG_CONFIG_PATH environment variable if you\r\ninstalled software in a non-standard prefix.\r\n\r\nAlternatively, you may set the environment variables GLIB_CFLAGS\r\nand GLIB_LIBS to avoid the need to call pkg-config.\r\nSee the pkg-config man page for more details.\r\n\r\nNo package 'glib-2.0' found\r\nNo package 'gmodule-2.0' found\r\n<\/pre>\n\ud750\ubbf8 \ub610 error… glib2.x86_64, glib2-devel.x86_64 \uc124\uce58\ud6c4 \uc7ac\uc2dc\ub3c4 <\/p>\n
]# yum install glib2.x86_64 glib2-devel.x86_64<\/pre>\n]# .\/configure --prefix=\/etc\/syslog-ng\r\n]# make; make install\r\n<\/pre>\n2. \uc124\uc815<\/p>\n
syslog-ng.conf \ud30c\uc77c\uc740 options{}, source{}, destination{}, filter{}, log{} \ubb38\uc73c\ub85c \uad6c\uc131<\/p>\n
options{} \uc740 \ub9d0\uadf8\ub300\ub85c \uc635\uc158\uc774\ubbc0\ub85c \uc0dd\ub7b5<\/p>\n
time_reopen : \uc7ac\uc2e4\ud589\uc2dc \ub300\uae30 \uc2dc\uac04
\nlog_fifo_size : output\ud050\ub97c \ub77c\uc778\uc218\uc5d0 \ub9de\ucd94\ub294 \ud06c\uae30
\nlong_hostnames : \uae34 \ud638\uc2a4\ud2b8\ub124\uc784\uc744 \uadf8\ub300\ub85c \uc4f8\uac83\uc778\uc9c0 \uc544\ub2cc\uc9c0 \uc124\uc815 on\/off\ub85c \uc9c0\uc815
\nuse_dns : dns\ucffc\ub9ac\ub97c \uc0ac\uc6a9\ud560 \uac83\uc778\uc9c0 \uc544\ub2cc\uc9c0 \uc124\uc815 yes\/no\ub85c \uc9c0\uc815(no\uc9c0\uc815\ub41c DOS(\uc11c\ube44\uc2a4 \uac70\ubd80 \uacf5\uaca9)\uc5d0 \ub9c9\uc544\ub0bc\uc218 \uc788\uac8c \ub41c\ub2e4.)
\nuse_fqdn : \ud638\uc2a4\ud2b8\ub124\uc784\uc744 \uc0ac\uc694\ud560 \uac83\uc778\uc9c0 \uc544\ub2c8\uba74 \uc804\uccb4 \ub3c4\uba54\uc778\uc744 \uc0ac\uc6a9\ud560 \uac83\uc778\uc9c0 \uc124\uc815
\ncreate_dirs : destination\ud30c\uc77c\uc744 \uc704\ud55c \ub514\ub809\ud1a0\ub9ac \uc0dd\uc131 \uc5ec\ubd80\ub97c \uc124\uc815 (yes\/no)<\/p>\nsource{} \ub294 \uc5b4\ub514\uc11c \ubd80\ud130 \ub85c\uadf8\ub97c \ubc1b\uc744 \uac83\uc778\uc9c0 \uc124\uc815\ud560 \uc218 \uc788\ub2e4.
\nfifo\/pipe, file, internal, sun-streams, tcp\/udp, usertty, unix-dgram \ub4f1\uc774 \uc62c \uc218 \uc788\ub2e4.<\/p>\n\uc608)<\/p>\n
source s_dgram\r\n{ unix-dgram(\"\/dev\/log\"); };\r\n\r\nsource s_internal\r\n{ internal(); };\r\n\r\nsource s_kernel\r\n{ pipe(\"\/proc\/kmsg\" log_prefix(\"kernel: \")); };\r\n\r\nsource s_tcp\r\n{ tcp(port(4800) keep-alive(yes) max_connections(100)); };\r\n<\/pre>\ndestination{} \ub294 \ub85c\uadf8\ub97c \uc5b4\ub5bb\uac8c \ubcf4\ub0bc(\uc800\uc7a5\ud560) \uac83\uc778\uac00\ub97c \uc124\uc815\ud560 \uc218 \uc788\ub2e4.
\nfifo\/pipe, file, program, tcp\/udp, unix-stream(unix-dgram) \ub4f1\uc774 \uc62c \uc218 \uc788\ub2e4.<\/p>\n\uc608)<\/p>\n
destination authlog { file(\"\/var\/log\/auth.log\"); };\r\ndestination bootlog { file(\"\/var\/log\/boot.log\"); };\r\ndestination debug { file(\"\/var\/log\/debug\"); };\r\ndestination secure { file(\"\/var\/log\/secure\"); };\r\ndestination user { file(\"\/var\/log\/user.log\"); };\r\n\r\ndestination hosts { file(\"\/var\/log\/HOSTS\/$HOST\/$YEAR\/$MONTH\/$DAY\/$FACILITY_$HOST_$YEAR_$MONTH_$DAY\" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); };\r\n\r\ndestination loghost { udp(\"10.1.1.254\" port(514)); };\r\n\r\ndestination users { usertty(\"*\"); };\r\n\r\ndestination swatch { program(\"\/usr\/bin\/swatch --read-pipe=\\\"cat \/dev\/fd\/0\\\"\"); };\r\n\r\ndestination database { pipe(\"\/tmp\/mysql.pipe\"\r\ntemplate(\"INSERT INTO logs (host, facility,\r\npriority, level, tag, date, time, program,\r\nmsg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY',\r\n'$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY',\r\n'$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\\n\")\r\ntemplate-escape(yes)); };\r\n<\/pre>\nfilter{}\ub294 \uc5ec\ub7ec\uac00\uc9c0 \ud568\uc218\ub97c \uc2e4\ud589\ud560 \uc218 \uc788\ub2e4. \ubcf4\ud1b5 \ub85c\uadf8 \uae30\ub85d\uc744 \ud544\ud130\ub9c1\ud558\uac8c \ub41c\ub2e4.
\nfacility() : facility\uc911 \uc77c\uce58\ud558\ub294 \ub85c\uadf8\ub97c \uac00\uc838\uc624\ub294 \ud568\uc218
\nfacility\uc758 \uac12 : auth, authpriv, cron, daemon, kern, lpr, mail, news, syslog, user, uucp, local0 – local7<\/p>\nlevel()\/priority() : level\/priority\uc911 \uc77c\uce58\ud558\ub294 \ub85c\uadf8\ub97c \uac00\uc838\uc624\ub294 \ud568\uc218.
\nlevel\/priority\uc758 \uac12 : (\uc5c4\uaca9\ub3c4\uac00 \uac10\uc18c\ud558\ub294 \uc21c\uc11c) debug, info, notice, warning, warn (same as warning),err, error (same as err), crit, alert, emerg, panic (same as emerg)<\/p>\nhost(regexp)<\/p>\n
match()<\/p>\n
program(regexp)<\/p>\n
\uc608 )<\/p>\n
\r\nfilter f_authpriv { facility(authpriv); };\r\nfilter f_daemon { facility(daemon); };\r\nfilter f_auth { facility(auth, authpriv); };\r\nfilter f_spooler { facility(uucp,news) and level(crit); };\r\nfilter f_syslog { not facility(auth, authpriv) and not facility(mail); };\r\nfilter f_emergency { level(emerg); };\r\nfilter f_err { level(err); };\r\n\r\nfilter f_test1 {\r\nhost(\"syslogdb\") and\r\nfacility(cron) and\r\nlevel(info)\r\n};\r\n\r\nfilter f_test2 {\r\nfacility(auth) and\r\nlevel(info) and\r\nmatch(\"su oracle\") and\r\nmatch(\" succeeded for root on \/dev\/\")\r\n};\r\n\r\nfilter f_postgres { not(\r\n(host(\"syslogdb\") and facility(cron) and level(info))\r\nor (facility(user) and level(notice)\r\nand ( match(\" gethostbyaddr: \")\r\nor match(\"last message repeated \")\r\n)\r\n)\r\nor ( facility(local3) and level(notice)\r\nand match(\" SYSMON NORMAL \"))\r\nor ( facility(mail) and level(warning)\r\nand match(\" writable directory\")\r\n)\r\nor ( ( host(\"dbserv1.somecompany.com\")\r\nor host(\"dbserv2.somecompany.com\")\r\n)\r\nand facility(auth) and level(info)\r\nand match(\"su oracle\") and match(\" succeeded for root on \/dev\/\")\r\n)\r\n); };\r\n<\/pre>\nlog{} \ub294 \uc9c0\uc815\ub41c source\ub97c filter\ub97c \uc801\uc6a9\ud574 destination\uc744 \uc2e4\ud589\ud55c\ub2e4.<\/p>\n
\uc608)<\/p>\n
\r\nlog { source(s_tcp); destination(message); };\r\n\r\nlog { source(s_internal); source(s_tcp); destination(loghost); };\r\n\r\nlog { source(s_dgram);\r\nsource(s_internal);\r\nsource(s_tcp); filter(f_auth); destination(authlog); };\r\n\r\nlog { source(s_dgram);\r\nsource(s_internal);\r\nsource(s_tcp); filter(f_mail);\r\nfilter(f_err); destination(mailerr); };\r\n<\/pre>\nudp 514\uc73c\ub85c \ub4e4\uc5b4\uc624\ub294 \ub85c\uadf8\ub97c host-yymmdd.log \uc73c\ub85c \uc800\uc7a5\ud558\uace0,
\n\ub85c\uadf8\uc5d0 HACK \uc774 \ub4e4\uc5b4\uc788\ub294 \ub85c\uadf8\ub294 \ub530\ub85c \ud544\ud130\ud574\uc11c hack-host-yymmdd.log \uc5d0 \uc800\uc7a5\ud558\ub3c4\ub85d \uc124\uc815<\/p>\n\r\noptions {\r\nflush_lines (0);\r\ntime_reopen (10);\r\nlog_fifo_size (1000);\r\nlong_hostnames (on);\r\nuse_dns (no);\r\nuse_fqdn (yes);\r\ncreate_dirs (yes);\r\nkeep_hostname (yes);\r\n};\r\n\r\nsource LOG_ZONE {\r\nudp(port(514));\r\n};\r\n\r\ndestination destfile {\r\nfile(\"\/logs\/$HOST-$YEAR$MONTH$DAY.log\" owner(root) group(root) perm(0600));\r\n};\r\n\r\nlog {\r\nsource(LOG_ZONE);\r\ndestination(destfile);\r\n};\r\n\r\nfilter f_hack {\r\nmatch(\"HACK\");\r\n};\r\n\r\ndestination destfile_filtered {\r\nfile(\"\/logs\/hack-$HOST-$YEAR$MONTH$DAY.log\" owner(root) group(root) perm(0600));\r\n};\r\n\r\nlog {\r\nsource(LOG_ZONE);\r\nfilter(f_hack);\r\ndestination(destfile_filtered);\r\n};\r\n<\/pre>\n\ucc38\uace0<\/p>\n
http:\/\/www.linuxhomenetworking.com\/wiki\/index.php\/Quick_HOWTO_:_Ch05_:_Troubleshooting_Linux_with_syslog
\nhttp:\/\/www.campin.net\/syslog-ng\/expanded-syslog-ng.conf
\nhttp:\/\/www.jjangu.pe.kr\/blog\/522
\nhttp:\/\/kltp.kldp.net\/stories.php?story=04\/02\/12\/9073427<\/p>\n<\/p>\n","protected":false},"excerpt":{"rendered":"
\ubaa9\ud45c : \ubaa8\ub4e0 \uc11c\ubc84\uc758 SYSLOG\ub97c \ub85c\uadf8 \uc11c\ubc84\ub85c \uc3d8\uac8c \ud558\uace0, \ub85c\uadf8\uc11c\ubc84\uc5d0\uc11c\ub294 HOST-yyyymmdd.log \ub97c \ub9cc\ub4e4\uc5b4 \uad00\ub9ac\ud558\ub3c4\ub85d \uc124\uc815. Syslog-NG(Syslog New Generation)\ub294 \ubcf4\ub2e4 \ud5a5\uc0c1\ub41c \ud544\ud130\ub9c1 \ubc0f \ud3ec\uc6cc\ub529 \uae30\ub2a5 \uc678\uc5d0 \uba54\uc2dc\uc9c0 \ubb34\uacb0\uc131\uacfc \uc554\ud638\ud654 \uae30\ub2a5\uc744 \ucd94\uac00\ud558\uc5ec syslog\uc758 \uc720\uc5f0\uc131\uc744 \uc99d\uac00\uc2dc\ucf30\uc73c\uba70, TCP\uc640 UDP \ud504\ub85c\ud1a0\ucf5c\uc744 \ud1b5\ud55c \uc6d0\uaca9 Logging\uc744 … Continue reading