Wednesday, November 11, 2009

php-syslog-ng/Logzilla on CentOS 5.3

Download the latest version of Logzilla to /var/www folder

1. cd /var/www/

2. tar xzvf logzilla_v2.9.9g.tgz

3. mv php-syslog-ng logzilla

4. mkdir -p /var/log/logzilla

5. Edit /opt/syslog-ng/etc/syslog-ng.conf

That is my config. You just have to look for destination d_logzilla in the end according to your settings.

options {
# Number of syslog lines stored in memory before being written to files
flush_lines (0);
log_fifo_size (2048);
create_dirs (yes);
perm (0640);
dir_perm (0750);
};
source s_network_2 {udp(ip(Ip address) port(514));};

destination d_network_2 {
file("/var/log/syslog-ng/network/$YEAR.$MONTH.$DAY/$HOST/$FACILITY.log");
};

# Define the destination "d_network_2B" log directory
destination d_network_2B {
file ("/var/log/syslog-ng/network/all/network.log");
};

log { source(s_network_2);
destination(d_network_2);
};

log { source(s_network_2);
destination(d_network_2B);
};

destination d_logzilla {
program("/var/www/logzilla/scripts/db_insert.pl"
template("$HOST\t$FACILITY\t$PRIORITY\t$LEVEL\t$TAG\t$YEAR-$MONTH-$DAY\t$HOUR:$MIN:$SEC\t$PROGRAM\t$MSG\n")
);

};

log {
source(s_network_2);
destination(d_logzilla);
};

6. gedit /etc/httpd/conf/httpd.conf
alias /loge "/var/www/logzilla/html"

You can choose any alias you want.

7. gedit /etc/php.ini
I changes value to
memory_limit = 128M
max_execution_time = 300

8. /etc/init.d/httpd restart

9. chown -R apache:apache /var/www/logzilla/html

10. http://localhost/loge

Everything should be green on web install page.

Please visit
for webinstall guide

After finishing with the webinstall
cd /var/www/logzilla/scripts
./fixpaths.sh
This will automatically fix the path.

11.cp /var/www/logzilla/scripts/contrib/system_configs/logrotate.d /etc/logrotate.d/logzilla

12. Crontab -e
# http://nms.gdd.net/index.php/LogZilla_Installation_Guide#Cron
# LogZilla
@daily php /var/www/logzilla/scripts/logrotate.php >> /var/log/logzilla/logrotate.log
@daily find /var/www/logzilla/html/jpcache/ -atime 1 -exec rm -f '{}' ';'
0,5,10,15,20,25,30,35,40,45,50,55 * * * * php /var/www/logzilla/scripts/reloadcache.php >> /var/log/logzilla/reloadcache.log

13. /etc/init.d/syslog-ng restart
http://localhost/loge

You will see the login page.
If you get error "The requested URL /login.php was not found on this server
Apache/2.2.3 (Red Hat) Server at localhost Port 80 "

14. Modify config.php and set:
define('SITEURL', '/loge/');

Browse again and you will see the login/password page.

Main Source: