How to Setup LogAnalyzer with Rsyslog On CentOS 7 / RHEL 7

Environment:

For the purpose of this guide, we will use 2 Centos 7 servers, one acts as rsyslog server with LogAnalyzer, and other acts as client.

Rsyslog Server :

OS: CentOS 7
IP address: 192.168.1.200
Hostname: loganalyzer.yallalabs.com

Client Server:

OS: CentOS 7
IP Address: 192.168.1.201
Hostname: server01.yallalabs.com

1./ Install Prerequisites

– In order for LogAnalyzer to function correctly, there are a number of prerequisite packages that need to be installed on our system.

– Install Httpd e php packages:

# sudo yum install httpd php php-mysql wget

– Enable at boot and start Httpd

# sudo systemctl enable httpd && systemctl start httpd

– If the firewalld is installed, you have to allow the http protocol :

$ sudo firewall-cmd --permanent --add-service=http 
$ sudo firewall-cmd --reload

– Install mariadb server and rsyslog-mysql package:

# sudo yum install mariadb-server -y rsyslog-mysql

– Enable at boot and start mariadb server:

# sudo systemctl enable mariadb && systemctl start mariadb

2./ Configure RSYSLOG Database

– Import the default database scheme offered by RSYSLOG using the below command:

# mysql -u root -p < /usr/share/doc/rsyslog-7.4.7/mysql-createDB.sql

- Create a user to access the Syslog database:

# mysql -u root -p
MariaDB [(none)]> GRANT ALL ON Syslog.* TO 'rsyslog'@'localhost' IDENTIFIED BY 'Password';
MariaDB [(none)]> FLUSH PRIVILEGES;
MariaDB [(none)]> exit

# sudo cp /etc/rsyslog.conf /etc/rsyslog.conf.org
# sudo vi /etc/rsyslog.conf

- Find and uncomment the following lines to make your server to listen on the udp and tcp ports.

[...]
$ModLoad imudp
$UDPServerRun 514

[...]
$ModLoad imtcp
$InputTCPServerRun 514
[...]

- Add the following lines to create a new forwarding rule and a load the mysql module:

[...]
# Load the MySQL Module
module(load="ommysql")
[...]
#*.* :ommysql:127.0.0.1,Syslog_Database,syslog_user,password
*.* :ommysql:127.0.0.1,Syslog,rsyslog,Password

- Save and restart the rsyslog service

# sudo systemctl restart rsyslog

3./ Install LogAnalyzer

- Download LogAnalyzer

# VERSION=4.1.10
# sudo wget http://download.adiscon.com/loganalyzer/loganalyzer-4.1.10.tar.gz -P /tmp
# sudo tar -xzvf /tmp/loganalyzer-${VERSION}.tar.gz -C /tmp

- Create the LogAnalyzer Directory under the apache web directory:

# sudo mkdir /var/www/html/loganalyzer

- Copy the installation files into loganalyzer directory using the following commands:

# sudo cp -r /tmp/loganalyzer-${VERSION}/src/* /var/www/html/loganalyzer
# sudo cp /tmp/loganalyzer-${VERSION}/contrib/configure.sh /var/www/html/loganalyzer

- Let's create a blank configuration file named config.php in loganalyzer directory and setup write permission to apache user using the following commands:

# cd /var/www/html/loganalyzer
# sudo bash configure.sh
# sudo chcon -h -t httpd_sys_script_rw_t config.php

- Allow the traffic to your server by executing the following commands:

# sudo firewall-cmd --add-port=514/{tcp,udp} --permanent
# sudo firewall-cmd --add-service=http --permanent
# sudo firewall-cmd --reload

4./ start LogAnalyzer web installer

After completing above steps open following url in your favorite web browser to start LogAnalyzer web installer.

http://localhost/loganalyzer

- Just click Next

Make sure config.php is writable and click Next

- Fill the database details for loganalyzer, with the rsyslog database name, user and password created in latest steps and click Next.

- Just click Next

- Create an Administrator account and click Next.

- Fill the Rsyslog database details and click Next

- click Finish

- Login to LogAnalyzer using Administrator credentials

We hope this tutorial was enough Helpful. If you need more information, or have any questions, just comment below and we will be glad to assist you!

If you like our content, please consider buying us a coffee. Thank you for your support!