Kejadian hacking beberapa waktu lalu cukup membuat anak-anak kerepotan dimana sylog local diserver banyak dihapus oleh pelaku jadi repot untuk tracking transaksi pada waktu tertentu, oleh karena itu baru niat banget untuk membangun syslog server tersentral (Dodol Ahhh) untuk memudahkan pemantauan, searching searching akhirnya dipilihlah syslog-ng karena sudah support forward data ke Mysql agar mudah diolah.
unila-log-gtw# cd /usr/ports/sysutils/syslog-ng
unila-inherent-gtw# make && make install
===> syslog-ng-1.6.12_1 depends on file: /usr/local/bin/libnet11-config - found
===> Configuring for syslog-ng-1.6.12_1
checking for a BSD-compatible install... /usr/bin/install -c -o root -g wheel
checking whether build environment is sane... ^C===> Script "configure" failed unexpectedly.
Please report the problem to lme@FreeBSD.org [maintainer] and attach the
"/usr/ports/sysutils/syslog-ng/work/syslog-ng-1.6.12/config.log" including
the output of the failure of your make command. Also, it might be a good idea
to provide an overview of all packages installed on your system (e.g. an `ls
/var/db/pkg`).
unila-log-gtw#
OK sampai disini tinggal menunggu proses instalasi selesai dan akan menghasilkan library dan file configurasi , untuk file konfigurasi tersimpan pada direktori
unila-log-gt# ll /usr/local/etc/syslog-ng/
total 24
-r--r--r-- 1 root wheel 6022 Jul 27 12:39 syslog-ng.conf
-r--r--r-- 1 root wheel 5564 Jul 27 10:46 syslog-ng.conf.sample
unila-log-gtw#
Buat file syslog-ng dengan perintah berikut
unila-log-gtw# mkfifo /var/log/mysql.pipe
Selanjutnya buat database mysql ;
unila-inherent-gt# mysql -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or g.
mysql> create database syslog;
Query OK, 1 row affected (0.00 sec)
mysql> use syslog;
Database changed
mysql> CREATE TABLE logs ( host varchar(32) default NULL, facility varchar(10) default NULL, priority varchar(10) default NULL, level varchar(10) default NULL, tag varchar(10) default NULL, datetime datetime default NULL, program varchar(15) default NULL, msg text, seq bigint(20) unsigned NOT NULL auto_increment, PRIMARY KEY (seq), KEY host (host), KEY program (program), KEY datetime (datetime), KEY priority (priority), KEY facility (facility) ) TYPE=MyISAM;
Query OK, 0 rows affected (0.00 sec)
mysql>
Continue reading “Syslog-ng base on Mysql – solusi untuk log system tersentral”