syslog搭建日志服务器

1、安装过程1、运行 Kiwi Syslog 安装包里的 Kiwi_Syslog_Server_921.Eval.setup.exe ，弹出安装界面，点击"I agree*Sjrslag Server 3-21 IsstiJ-LerLicense AgreementPlease review the ken terms before stalling 图轴i SyslogServer 9. ZJ .Press Page LXjvjh to see the rest of the ayernent.SOLARWINDSEND USER LICENSE AGREEMENTIMPORTAMT

2、- READ CAREFULLY BEFORE USING THIS : SOFTWARE: THIS IS A LEGAL AGREEMEMT BETWEEN YOU W(EITHER INDIVIDUAL OR A SINGLE EMT1TY) ANDSOLARWINDS WORLDWIDE. LLC COVERING YOUR USE OF 3I “ 卜 i、产 k d 小 d 凸 m, nr c c k%Ln 力 j hl j m 机量断-ri-.h i /a j # hl.*IF you accept the terms of the agreement, click I Agree

3、 to continue. You must accept the a5refiment to inskll Kiwi Syslog Server 9.?,1 .Sof2rWindfj Inc,I AgreeCancel2、选择安装模式为"Install Kiwi Syslog Server as a service ,两者的区别是，前者可以在关闭软件主界面后仍然能记录日志，后者只能瞬时记录日志3、选择安装的用户，本地系统账户还是一个管理员的账户4、勾选"Install Kiwi Syslog Web Access（可以不勾选），因为他提示了此功能只限注册用户使用、5、选择

4、安装的组件6、选择安装的路径7、若第四步中没有勾选安装 Kiwi Syslog Web Access ,则会提示安装成功，若勾选了，则会提示安装KiwiSyslog Web Access 必备组件的向导，安装过程会自动下载并安装这些组件、2£1Kivi SysloVeb AccessPrerequisitesThesfl programs are needed for the ppllutlon to run. dick on the checkbox newt to a prwaqutelte to select fc for Mal or to skip it.NameVersi

5、onAction口 如indwJs Installer 3-1kequred: 3.1 Dr higher. Found： 3.1 ,4000.3959.Skip0 MicroscFt .MET Frame,Required; any. Found： nothing,DorJoad Vi5LMl C+2000 5P1 .,Retiuired: any> Found； nothing.DownloadQ A5P.NET AJAX 1.0R.equired: 1.0 or higher. Found: nothri.icwnfciad0 3QL Server Compadt 3.,.Requ

6、ired: any. Found： nothing.)owntoad0 LADw Cassini Wm Se.TRequired: 2,1.0.3 ar higher. Faund: nothing.InstallDownload Folder； |c； Pro gram Hle53olarWinrisKivji 5yslog Web AccessSetupBrowse.Press the Next button t口 dov/nload the prerequisites.上一步但“下一步垣匚|翔 | 取消 |Prerequisites InstallPleasa wait while th

7、s selected prerequisites art installed.NameMicrosoft .NET Framework Version 2,0 Redistributable PackageIm 如 ling.Visual C4+ 3008 5P1 RedistributablePendingA5P.NET AJAX 1.0PendingSQL Server Compact 3.5 SP1PendingUltitev Cassini Web ServerPendingIn5tdlinq Fiisroscft NET Frpneworls Version 乙。Rqdistribu

8、HbL PmL 昨溺G Frorn； C:Prograw Fils1521kMn亚城网 Sy slog Wteb a“es nSetup Viotri etfM.exe/,，»wi rwnarr"Liiain ( »?< iiibiijbiii rm »« m iiimi mini nn inarrm bl ( irnrt(«,( ib iii imim ibii iit-hii m mi rninarn'BiiiB mniBi iiBimmiBrn'Biir“ Automatically start instd

9、lirK tlie m己in己pplkdtjon 己ftcr finishing the prerec|ui5ite5 instdiLi I 11 I MM Illi! Mil niHaill I MM 111 MM I 1»» 11 1 I I MM 111 VW1 ! RM Ml I IM 111 I IIMHIII 111 MI I ! 11 VI I Hain I IMB111 MmH I UMI 11 NBM |ArBUI IMMillirMil IIMaail MM IIF8、之后就会弹出 Kiwi Syslog Web Access 的安装向导过程，也比较简单

10、soimrwindThe Kiwi Syslog Web Access Setup Wizard ended prematurelyKiwi Syslog WeL Access setup ended premalurely because of mn error, Your system h时 not bmn modified To install this program at a later 曰制晶 please ruri the inftalation aqai-i.CfcL the 'iFinish" bqtSn g exit the Setup Wieard.I

11、,IU nil IlbB-illlFinish，11 i i”ii一”“，'之工昭；iri Syslo g S er ver 9.1 Tikst alleFpgpCompleting the Kiwi Sysllog Server9.2.1 Setup WizardKiwi Sydog Server,2.1 ha筝 bean installed on your computer.Click Finish to Jome this wizard.“ LinKkvl Syslog Server 5.2.1!Visit the Solar Winds ebeite"I b, -!

12、iiirmi m ini tvialinniiai-HiiiaTHiHirmiiHn-i mr mi im il9、在 Kiwi Syslog 的安装包里还有个工具SolarWinds_LogForwarder_1115_Eval_Setup.exe ,安装也比 较简单，这里不详细介绍 配置过程Kiwi Syslog Server的各种详细配置主要在里面。我们主要介绍2个方面的配置1、log文件的存放路径，点击Rules-Actions-Log to file ,这里我们就可以设置存放的位置以及存放的格式Log File Flotalion-Rules£ V DefaultFiker

13、s-Actions“一.封 口一由4I T百4深安幽j I+iy Log to Syslog Web Accesi+ 讨 Log to Sv£lot Web AccessSchediJes-FornfiatiigCuston file fwmatsCustonDE formats2、配置计划任务，点击 Rules-Shedules-Add new scheduleSchedule字段 添加日志计划频率（按小时算、每 6个小时记录一次，一天记录 4次）Schedule | Source DeUination Archive Option; Archive Notifications |

14、Schedule start( Date: | 30 Dec 2010 Tima 113rO5 § 厂 UTC C NmrSchedule frequence)I1ilIOnce Minute Hour Dav Week Month YearRun at: | 00:00 Ft' I- UTC, every:国何国Source字段（设置临时存储日志的路径）ScheduleDestinationArchive Options |Archive Notification?Soares boa tian| C:Progfam FilesSvslogdLogsDestination字

15、段（设置最终日志存储目录）Schedule SourceDestinationArchive Options |Archive NotificationsDeslination location|CAPtogram FilxSyMo 9dleiat日 d Logs实例测试Windows环境（亲测）把这两个文件拷贝到c:windowssystem32 目录下。打开 Windows命令提示符（开始 >运行输入CMD）C:>evtsys T h 00-i表示安装成系统服务-h指定10g服务器的IP地址如果要卸载evtsys,则：net stop evtsys ev

16、tsys -u启动该服务：C:>net start evtsys打开windows组策略编辑器 （开始-> 运行 输入gpedit.msc）在windows设置 > 安全设置 > 本地策略 >审核策略 中，打开你需要记录的 windows日志。evtsys 会实时的判断是否有新的 windows日志产生，然后把新产生的日志转换成 syslogd可识别的格式，通过UDP 3072端口发送给syslogd服务器。I Ei11sg: Service lajLager (30Day trial - V er si9. 2)|ile EditYi ewHelp:! 21 向

17、小图Q| Display 0(* (Defaull)"3D Days left in evaluatioinDatelimePriorityH of (nameMessageA12-30-2010fb:56:25D aemon.N o lice7DecO 1O:5G:25 PC-20ft）041DEPKV Security: G眨 PC-201 D04rDBPVXAdministrator: 迨七朝舞虚徽存装二建扮近理？器若期痘摩触-诲年画口范-漫睢簿四块糅- 91双津员陪戴-富恬用要密衰-绛桁理般存皎+ *弊辇建 TY曲矍始整-维 经货燕簸玛旋株-亩糟阻，梦

18、做有敲浜？鎏儿垠卷？ Adfnin&lr.Wi S«N：12-30-20101 0:55:50D aemon.N o lice7Dec 30 10:55:45 PC-201 0U410DPKV S?rvice.ConhoLManager: 7035:PC-201004100PKVXAdmmistrAtor: Eventlog lo Sslog 辞遂蛉箱卷蛔壁鞋£偏哥谓12-30-201D10:55:50D aemon.N q hce7Dec 30 10:55:45 PC-201 0041 OBPKV Service-ContrDl Manager; 7O3G: Evenllog toSy slog骁盘好后船他殊蜉濠档悭 建肥号拼的12-30-2D1D10； 55:45D aemon_ N o lice192JGS.