> ## Documentation Index
> Fetch the complete documentation index at: https://doc.lwops.cn/llms.txt
> Use this file to discover all available pages before exploring further.

# 12.1. syslog监控

> syslog安装1，安装服务如果是本地YUM源，连接不了网上源，应该有两个服务安装不了，在测试步骤会报错，再将服务补全 yum install perl-JSON-XS perl-libwww-perl perl-LWP-Protocol-https perl-Config-Generalyu...

# syslog安装

## 1，安装服务

> 如果是本地YUM源，连接不了网上源，应该有两个服务安装不了，在测试步骤会报错，再将服务补全 yum install perl-JSON-XS perl-libwww-perl perl-LWP-Protocol-https perl-Config-General

```plain theme={null}
yum install perl-JSON-XS perl-libwww-perl perl-LWP-Protocol-https perl-Config-General
```

![12.1. syslog监控 操作截图 1](https://lwweb.oss-cn-shenzhen.aliyuncs.com/docs/images/yuque/syslog/image-01.png)

```plain theme={null}
编辑 /etc/zabbix/zabbix_syslog.cfg
#设置zabbix首页地址，乐维为/z 结尾
url = http://localhost/z/api_jsonrpc.php
# 用户使用新创建超管用户，不可直接用Admin用户


编辑配置文件

vim /etc/rsyslog.d/zabbix_rsyslog.conf
# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

#enables omrpog module
$ModLoad omprog

$template RFC3164fmt,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%"
$template network-fmt,"%TIMESTAMP:::date-rfc3339% [%fromhost-ip%] %pri-text% %syslogtag%%msg%\n"

#exclude unwanted messages(examples):
:msg, contains, "Child connection from" stop
:msg, contains, "exit after auth (ubnt): Disconnect received" stop
:msg, contains, "password auth succeeded for 'ubnt' from" stop
:msg, contains, "exit before auth: Exited normally" stop

#将IP改为不存在的地址
if $fromhost-ip != '9.9.9.9' then {
action(type="omprog" binary="/etc/zabbix/scripts/zabbix_syslog_lkp_host.pl" template="network-fmt")
stop
}

保存退出，重启服务

service rsyslog restart
```

## 2，将syslog模板导入到zabbix服务器中

## 3，测试效果

```plain theme={null}
[IP]为接收日志的服务器地址
echo "2017-12-19T09:26:26.314936+03:00 [127.0.0.1] syslog.info SysLogTest[4616]Test syslog message" | /etc /zabbix/scripts/zabbix_syslog_lkp_host.pl
```

![12.1. syslog监控 操作截图 2](https://lwweb.oss-cn-shenzhen.aliyuncs.com/docs/images/yuque/syslog/image-02.png)

**perl脚本会缺少很多需要的库，去这个网站搜**：[https://metacpan.org/](https://metacpan.org/) **比如：Can't locate Types/Serialiser.pm in @INC 搜Types::Serialiser下载完安装包，进行安装（Canary-Stability-2012.tar.gz、common-sense-3.74.tar.gz、JSON-XS-4.0.tar.gz、Types-Serialiser-1.0.tar.gz）依赖包存放目录在depened\_app下**

```plain theme={null}
安装方法如下：
perl Make.pl
make && make install
```

## 4，资料补充

> [https://github.com/v-zhuravlev/zabbix-syslog](https://github.com/v-zhuravlev/zabbix-syslog) 作者上传到github的新版 [https://segmentfault.com/a/1190000003509909](https://segmentfault.com/a/1190000003509909) rsyslog配置文件说明 [https://habr.com/company/zabbix/blog/252915/](https://habr.com/company/zabbix/blog/252915/) 作者首发 perl脚本会缺少很多需要的库，去这个网站搜：[https://metacpan.org/](https://metacpan.org/) 比如：Can't locate Types/Serialiser.pm in @INC 搜Types::Serialiser