{"id":5074,"date":"2020-02-28T23:29:39","date_gmt":"2020-02-28T20:29:39","guid":{"rendered":"https:\/\/kifarunix.com\/?p=5074"},"modified":"2024-03-14T19:22:40","modified_gmt":"2024-03-14T16:22:40","slug":"install-and-setup-adiscon-loganalyzer-on-centos-8","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/install-and-setup-adiscon-loganalyzer-on-centos-8\/","title":{"rendered":"Install and Setup Adiscon LogAnalyzer on CentOS 8"},"content":{"rendered":"\n

In this guide, we are going to learn how to install and setup Adiscon LogAnalyzer on CentOS 8. Adiscon LogAnalyzer<\/a> is a web interface to syslog\/Rsyslog and other network event data. It provides easy browsing, analysis of real time network events and reporting services.<\/p>\n\n\n\n

Installing Adiscon LogAnalyzer on CentOS 8<\/h2>\n\n\n\n

In this demo, we will be collecting logs using Rsyslog and store them on a database, preferrably MariaDB from where LogAnalyzer will read and analyze them.<\/p>\n\n\n\n

As such, step through this guide to setup Adiscon LogAnalyzer with Rsyslog and MariaDB on CentOS 8.<\/p>\n\n\n\n

Run System Update<\/h3>\n\n\n\n

Resynchronize your system packages to their latest versions by running the command below;<\/p>\n\n\n\n

dnf update<\/code><\/pre>\n\n\n\n
Install LAMP Stack on CentOS 8<\/h3>\n\n\n\n
Almost every web application requires a L[AE]MP stack. LogAnalyzer is no exception. Follow the guide below to learn how to install LAMP stack on CentOS 8.<\/p>\n\n\n\n
Install LAMP Stack on CentOS 8<\/a><\/p>\n\n\n\n
Create LogAnalyzer Database and Database User<\/h3>\n\n\n\n
Once the LAMP stack is installed and setup, create LogAnalyzer database and database user. This step can be made simple by installing rsyslog-mysql<\/code> package which provides a sample Rsyslog MySQL schema which can be just imported into MySQL\/MariaDB server.<\/p>\n\n\n\n
To install rsyslog-mysql<\/code> package, run the command below;<\/p>\n\n\n\n
dnf install rsyslog-mysql -y<\/code><\/pre>\n\n\n\n
Once the installation is done, import Rsyslog MySQL database schema, \/usr\/share\/doc\/rsyslog\/mysql-createDB.sql<\/code>, into MySQL\/MariaDB.<\/p>\n\n\n\n
mysql -u root -p < \/usr\/share\/doc\/rsyslog\/mysql-createDB.sql<\/code><\/pre>\n\n\n\n
This command will create a database called Syslog<\/code> on MariaDB\/MySQL db server.<\/p>\n\n\n\n
If you want to use a different name of the database, simply edit the schema and make necessary changes.<\/p>\n\n\n\n
Next, login to MySQL\/MariaDB and create a LogAnalyzer database user with all the privileges granted on the database imported above<\/p>\n\n\n\n
mysql -u root -p<\/code><\/pre>\n\n\n\n
Check available databases;<\/p>\n\n\n\n
show databases;<\/code><\/pre>\n\n\n\n
+--------------------+\n| Database           |\n+--------------------+\n| Syslog<\/strong>             |\n| information_schema |\n| mysql              |\n| performance_schema |\n+--------------------+\n4 rows in set (0.001 sec)<\/code><\/pre>\n\n\n\n
Replace the user and its password accordingly<\/strong>.<\/p>\n\n\n\n
grant all on Syslog.* to logadmin@localhost identified by 'str0ngP@ssW0rd';<\/code><\/pre>\n\n\n\n
Reload the privileges tables and quit the database.<\/p>\n\n\n\n
flush privileges;<\/code><\/pre>\n\n\n\n
quit<\/code><\/pre>\n\n\n\n
Configure Rsyslog<\/h2>\n\n\n\n
To begin with, configure Rsyslog to enable UDP and TCP syslog reception. This can be done by commenting out (removing comments, #<\/strong>) at the beginning of the following highlighted lines;<\/p>\n\n\n\n
...\n# Provides UDP syslog reception\n# for parameters see http:\/\/www.rsyslog.com\/doc\/imudp.html\nmodule(load=\"imudp\")<\/strong>\ninput(type=\"imudp\" port=\"514\")<\/strong>\n...<\/code><\/pre>\n\n\n\n
If you also want to receive logs via TCP, simply uncomment the following highlighted lines.<\/p>\n\n\n\n
...\n# Provides TCP syslog reception\n# for parameters see http:\/\/www.rsyslog.com\/doc\/imtcp.html\nmodule(load=\"imtcp\")\ninput(type=\"imtcp\" port=\"514\")<\/strong><\/code><\/pre>\n\n\n\n
Next, enable load the Rsyslog MySQL module to enable you to forward logs into MySQL\/MariaDB database. This can be done by the use of ommysql<\/strong><\/code> Rsyslog module as shown below. See the highlighted lines;<\/p>\n\n\n\n
Be sure to replace the server, serverport, database name, database user and password<\/strong> accordingly.<\/p>\n\n\n\n
...\n#### MODULES ####\n\nmodule(load=\"imuxsock\"    # provides support for local system logging (e.g. via logger command)\n       SysSock.Use=\"off\") # Turn off message reception via local log socket; \n                          # local messages are retrieved through imjournal now.\nmodule(load=\"imjournal\"             # provides access to the systemd journal\n       StateFile=\"imjournal.state\") # File to store the position in the journal\n#module(load=\"imklog\") # reads kernel messages (the same are read from journald)\n#module(load\"immark\") # provides --MARK-- message capability\n# Enable MySQL Logging\nmodule(load=\"ommysql\")\naction(type=\"ommysql\" server=\"localhost\" serverport=\"3306\"\n       db=\"Syslog\" uid=\"logadmin\" pwd=\"str0ngP@ssW0rd\")<\/strong>\n...<\/code><\/pre>\n\n\n\n
Rsyslog is now ready to receive logs and forward them to MySQL database. However, you might need to restrict log forwarding to Rsyslog using the $AllowedSender<\/code><\/strong> parameter.<\/p>\n\n\n\n
This parameter takes the format;<\/p>\n\n\n\n
$AllowedSender [UDP\/TCP], ip[\/bits], ip[\/bits]<\/strong><\/code><\/pre>\n\n\n\n
Hence, to allow specific servers to send logs to Rsyslog server, you would simply add a line like as shown below under the ### GLOBAL DIRECTIVES ###<\/code><\/strong> section.<\/p>\n\n\n\n
$AllowedSender UDP, 192.168.56.0\/24, [::1]\/128, *.kifarunix-demo.com<\/strong><\/code><\/pre>\n\n\n\n
To define servers allowed for TCP syslog reception;<\/p>\n\n\n\n
$AllowedSender TCP, 192.168.56.0\/24, [::1]\/128, servera.kifarunix-demo.com<\/strong><\/code><\/pre>\n\n\n\n
Basic Rsyslog configuration is done. Save the configuration and restart rsyslog;<\/p>\n\n\n\n
systemctl restart rsyslog<\/code><\/pre>\n\n\n\n
Allow Rsyslog remote connection via FirewallD;<\/p>\n\n\n\n
firewall-cmd --add-port=514\/{tcp,udp} --permanent<\/code><\/pre>\n\n\n\n
firewall-cmd --reload<\/code><\/pre>\n\n\n\n
Install LogAnalyzer on CentOS 8<\/h2>\n\n\n\n
To install LogAnalyzer on CentOS 8, download the latest stable release version of LogAnalyzer from the downloads page<\/a>. You can simply use wget command to pull the tarball as shown below;<\/p>\n\n\n\n
wget http:\/\/download.adiscon.com\/loganalyzer\/loganalyzer-4.1.10.tar.gz<\/code><\/pre>\n\n\n\n
Extract LogAnalyzer Tarball<\/h3>\n\n\n\n
Once the download is complete, extract LogAnalyzer tarball.<\/p>\n\n\n\n
tar xzf loganalyzer-4.1.10.tar.gz<\/code><\/pre>\n\n\n\n
Install LogAnalyzer<\/h3>\n\n\n\n
Sine LogAnalyzer is a web application, you can install on your default web server root directory. You can however create LogAnalyzer directory under the web root directory.<\/p>\n\n\n\n
mkdir \/var\/www\/html\/loganalyzer<\/code><\/pre>\n\n\n\n
Next, upload all files from the loganalyzer\/src\/<\/strong> folder to your web server root directory created above.<\/p>\n\n\n\n
cp -r loganalyzer-4.1.10\/src\/* \/var\/www\/html\/loganalyzer\/<\/code><\/pre>\n\n\n\n
Next, copy the loganalyzer-4.1.10\/contrib\/configure.sh<\/code> to the web root directory.<\/p>\n\n\n\n
cp loganalyzer-4.1.10\/contrib\/configure.sh \/var\/www\/html\/loganalyzer\/<\/code><\/pre>\n\n\n\n
Next, execute the script to create a required empty, contrib.php<\/code> file and set the necessary permissions.<\/p>\n\n\n\n
cd \/var\/www\/html\/loganalyzer\/<\/code><\/pre>\n\n\n\n
bash configure.sh<\/code><\/pre>\n\n\n\n
Edit the default Apache configuration and set the adjust the web root directory appropriately.<\/p>\n\n\n\n
vim \/etc\/httpd\/conf\/httpd.conf<\/code><\/pre>\n\n\n\n
# DocumentRoot \"\/var\/www\/html\"\nDocumentRoot \"\/var\/www\/html\/loganalyzer\"<\/strong><\/code><\/pre>\n\n\n\n
Save the configurations, quit and restart Apache;<\/p>\n\n\n\n
httpd -t<\/code><\/pre>\n\n\n\n
systemctl restart httpd<\/code><\/pre>\n\n\n\n
Configure SELinux<\/h3>\n\n\n\n
Unify HTTPD handling of all content files;<\/p>\n\n\n\n
setsebool -P httpd_unified 1<\/code><\/pre>\n\n\n\n
Allow httpd network connection<\/p>\n\n\n\n
setsebool -P httpd_can_network_connect 1<\/code><\/pre>\n\n\n\n
Allow httpd to graceful shutdown<\/p>\n\n\n\n
setsebool -P httpd_graceful_shutdown 1<\/code><\/pre>\n\n\n\n
Allow httpd network relay connection<\/p>\n\n\n\n
setsebool -P httpd_can_network_relay 1<\/code><\/pre>\n\n\n\n
Finalize LogAnalyzer Setup on Browser<\/h3>\n\n\n\n
LogAnalyzer is now setup. You can access it via the address http:\/\/server_IP_OR_Hostname<\/code><\/strong><\/p>\n\n\n\n
When you encounter the error, shown below, simply click here<\/strong> to proceed.<\/p>\n\n\n\n
\"LogAnalyzer<\/figure>\n\n\n\n
Click Next to check if all the required prereqs are met.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Ensure that the config.php file is writeable.<\/p>\n\n\n\n
Under Basic configuration, enable User database and set the right database connection details.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Click Next to create the necessary database tables used by the LogAnalyzer User System.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Ensure that all queries execute successfully on Step 5.<\/p>\n\n\n\n
Create LogAnalyzer Administrator User Account.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Create the first source for syslog messages. In this case, select MySQL native<\/strong> and provide the correct database connection details. Note the following default Database and Table names;<\/p>\n\n\n\n
CREATE DATABASE Syslog<\/strong>;\nUSE Syslog;\nCREATE TABLE SystemEvents<\/strong>\n...<\/code><\/pre>\n\n\n\n
\"LogAnalyzer<\/figure>\n\n\n\n
Click Next to finalize the LogAnalyzer setup.<\/p>\n\n\n\n
When you click Finish<\/strong>, it takes you to LogAnalyzer login page.<\/p>\n\n\n\n
Login as administrator user you created on Step 6. Upon successful login, boom, you land on the dashboard.<\/p>\n\n\n\n
\"LogAnalyzer<\/figure>\n\n\n\n
If you want to enable auto refresh for realtime streaming, see screenshot below;<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
You have successfully installed LogAnalyzer. That marks the end of our tutorial on how to installing Adiscon LogAnalyzer on CentOS 8.<\/p>\n\n\n\n
Read more on LogAnalyzer INSTALL ReadMe<\/a><\/p>\n\n\n\n
Related Tutorials;<\/h3>\n\n\n\n
Configure NXLog to Forward System Logs to Rsyslog Server on Ubuntu 18.04<\/a><\/p>\n\n\n\n
Configure Rsyslog on Solaris 11.4 to Send logs to Remote Log Server<\/a><\/p>\n\n\n\n
How to Configure Remote Logging with Rsyslog on Ubuntu 18.04<\/a><\/p>\n\n\n\n
A Basic Introduction to Rsyslog Filters<\/a><\/p>\n\n\n\n
Configure Syslog on Solaris 11.4 for Remote Logging<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
In this guide, we are going to learn how to install and setup Adiscon LogAnalyzer on CentOS 8. Adiscon LogAnalyzer is a web interface to<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,191,331],"tags":[1142,1298,1299,1300,1297,136],"class_list":["post-5074","post","type-post","status-publish","format-standard","hentry","category-howtos","category-rsyslog","category-syslog","tag-centos-8","tag-loganalyzer","tag-loganalyzer-centos-8","tag-loganalyzer-mariadb","tag-loganalyzer-rsyslog","tag-mariadb","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/5074"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=5074"}],"version-history":[{"count":6,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/5074\/revisions"}],"predecessor-version":[{"id":21324,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/5074\/revisions\/21324"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=5074"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=5074"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=5074"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}