Ubuntu下rsyslog集中收集mysql審計日志

服務端

1、安裝最新版本rsyslog

sudo apt-get install software-properties-common python-software-properties
sudo add-apt-repository ppa:adiscon/v8-stable 
sudo apt-get update
sudo apt-get install rsyslog

2、配置目錄存儲mysql審計日志

vim /etc/rsyslog.d/50-default.conf
# add: define logfiles
$template Mysql-audit,"/var/log/remote_log/%app-name%/%hostname%_%fromhost-ip%_log_%app-name%_%$YEAR%-%$MONTH%-%$DAY%.log"
$template Remote,"/var/log/remote_log/%hostname%_%fromhost-ip%/log_%app-name%_%$YEAR%-%$MONTH%-%$DAY%.log"
# Log all messages to the dynamically formed file.
:app-name,isequal,"mysql-audit" ?Mysql-audit
:fromhost-ip, !isequal, "127.0.0.1" ?Remote
& stop

3、安裝MySQL以及rsyslog-mysql模塊，

apt-get install rsyslog-mysql mysql-server -y #安裝過程中會自動創建表

4、配置/etc/rsyslog.d/50-default.conf，以便將mysql的審計日志本地保留一份,mysql數據庫里寫一份

vim /etc/rsyslog.d/50-default.conf
$ModLoad ommysql #加載ommysql模塊,將日志寫入mysql
$template Remote,"/var/log/remote_log/%hostname%_%fromhost-ip%/log_%app-name%_%$YEAR%-%$MONTH%-%$DAY%.log"
$template Mysql-audit,"/var/log/remote_log/%app-name%/%hostname%_%fromhost-ip%_log_%app-name%_%$YEAR%-%$MONTH%-%$DAY%.log"
:app-name,isequal,"mysql-audit" ?Mysql-audit
& :ommysql:localhost,Syslog,rsyslog,123.com #在前一行的日志匹配動作之后,繼續將日志插入到mysql
:fromhost-ip, !isequal, "127.0.0.1" ?Remote
& stop #結束前面的匹配信息,包括mysql-audit的匹配.

　　

客戶端

1、安裝最新版本syslog

sudo apt-get install software-properties-common python-software-properties
sudo add-apt-repository ppa:adiscon/v8-stable 
sudo apt-get update
sudo apt-get install rsyslog

2、rsyslog配置(注意如果升級為8.30.0之后 不需要state文件配置)

創建配置文件 /etc/rsyslog.d/mysql-audit.conf
#mysql-audit.log
module(load="imfile" PollingInterval="10") #加載模塊
input(type="imfile" File="/data/mysqldata/mysql_audit.log" #定義文件位置
                Tag="mysql-audit" #打tag
                #StateFile="/var/spool/rsyslog/mysql-audit.state" #inotify 狀態
                Severity="error" #log級別
                Facility="local7") #rsyslog 級別
local7.* @10.25.109.64:514 #傳送log服務器
#end

3、修改syslog的記錄,過濾掉mysql日志,不記錄本機syslog

:app-name,isequal,"mysql-audit" stop
*.*;auth,authpriv.none          -/var/log/syslog

4、重啟rsyslog以及設定文件權限

touch /var/spool/rsyslog/mysql-audit.state
chown syslog.adm /var/spool/rsyslog/mysql-audit.state
usermod -G mysql syslog
/etc/init.d/rsyslog restart