Installation eines Logservers mit Loganalyzer als Debian-VM auf Hyper-V

debian-9.5.0-amd64-netinst.iso

apt-get install hyperv-daemons

apt-get install mysql-server

mysql -u root -p

apt-get install rsyslog-mysql

apt-get install apache2 php php-mysql

http://download.adiscon.com/loganalyzer/loganalyzer-4.1.6.tar.gz

cd /usr/src
wget http://download.adiscon.com/loganalyzer/loganalyzer-4.1.6.tar.gz
tar xzf loganalyzer-4.1.6.tar.gz
cp -r loganalyzer-4.1.6/src/ /var/www/html/loganalyzer
chown -R www-data:www-data /var/www/html/loganalyzer

ip address

rm /var/www/html/loganalyzer/config.php

mysql -u root -p
show databases;

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| Syslog             |
| information_schema |
| mysql              |
| performance_schema |
+--------------------+
MariaDB [(none)]> use Syslog;
MariaDB [Syslog]> show tables;
+------------------------+
| Tables_in_Syslog       |
+------------------------+
| SystemEvents           |
| SystemEventsProperties |
| logcon_charts          |
| logcon_config          |
| logcon_dbmappings      |
| logcon_fields          |
| logcon_groupmembers    |
| logcon_groups          |
| logcon_savedreports    |
| logcon_searches        |
| logcon_sources         |
| logcon_users           |
| logcon_views           |
+------------------------+

apt-get install snmp snmptrapd

#
# EXAMPLE-trap.conf:
#   An example configuration file for configuring the Net-SNMP snmptrapd agent.
#
###############################################################################
#
# This file is intended to only be an example.
# When the snmptrapd agent starts up, this is where it will look for it.
#
# All lines beginning with a '#' are comments and are intended for you  
# to read.  All other lines are configuration commands for the agent.

#
# PLEASE: read the snmptrapd.conf(5) manual page as well!
#
#authCommunity log,execute,net private　
authCommunity log public
#
## send mail when get any events
#traphandle default /usr/bin/traptoemail -s smtp.example.org foobar@example.org
#
## send mail when get linkDown
#traphandle .1.3.6.1.6.3.1.1.5.3 /usr/bin/traptoemail -s smtp.example.org foobar@example.org

service snmptrapd restart

### Configuration file for rsyslog-mysql
### Changes are preserved

# $ModLoad ommysql
# *.* :ommysql:localhost,Syslog,rsyslog,GEHEIM2

#  /etc/rsyslog.conf    Configuration file for rsyslog.
#
#                       For more information see
#                       /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html


#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging  
module(load="imklog")   # provides kernel logging support  
#module(load="immark")  # provides --MARK-- message capability  

module(load="ommysql")  
module(load="imudp")  
module(load="imtcp")  

ruleset(name="nonlocal"){  
        # Bintec Filter - überflüssige Meldungen werden verworfen
        :msg, startswith, " DHC6: Updating IPv6-prefix" stop  
        :msg, startswith, " DHC6: Adding virtual IPv6-prefix" stop  
        :msg, startswith, " DHC6: Removing virtual IPv6-prefix" stop  
        :msg, startswith, " NAT: denied incoming session on ifc 30010001" stop  
        :msg, startswith, " NDISC: <Telekom>: Got Router Advertisement with prefix" stop  
        # MYSQL-logging
        action(type="ommysql" server="127.0.0.1" db="Syslog" UID="rsyslog" PWD="GEHEIM2")  
}

input(type="imudp" port="514" ruleset="nonlocal")  
input(type="imtcp" port="514" ruleset="nonlocal")  



###########################
#### GLOBAL DIRECTIVES ####
###########################


#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf


###############
#### RULES ####
###############


# snmptrapd-Augaben immer an mysql senden
:syslogtag, contains, "snmptrapd" :ommysql:127.0.0.1,Syslog,rsyslog,GEHEIM2  
:msg, contains, "NET-SNMP" :ommysql:127.0.0.1,Syslog,rsyslog,GEHEIM2  

# Lokale Ereignisse erst ab *.warn in die mysql-Datenbank schreiben.
*.warn :ommysql:127.0.0.1,Syslog,rsyslog,GEHEIM2

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#

mail.info                       -/var/log/mail.info
mail.warn                       -/var/log/mail.warn
mail.err                        /var/log/mail.err

#
# Some "catch-all" log files.  
#
*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none          -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg                         :omusrmsg:*

service rsyslog restart