How to install and configure a SysLog Server

The following document describes how to install and configure a SysLog Server on a CentOS 6.5 Linux Operating System. The steps described below can also be applied to other distributions with very minor corrections. For more information check the corresponding documentation.

The solution is based on three main component:

LAMP stack (Linux, Apache, MySQL, PHP)
Rsyslog server http://www.rsyslog.com/
LogAnalyzer http://loganalyzer.adiscon.com/

This guide assumes that both SELinux and IPTables are disabled and not running. If that kind of security level is necessary, check the proper documentation.

Apache

To install Apache Web server open a root command line and type:

[root@localhost ]# yum install httpd

Start the server:

[root@localhost ]# service httpd start

Set automatically start the server at boot time:

[root@localhost ]# chkconfig httpd on

Test the Apache installation:

Open http://localhost or http://your-server-address on your web browser of choice and check if Apache is working. You should see a page like this:

MySQL

To install MySQL database, open a root command line and type:

[root@localhost ]# yum install mysql mysql-server

Start the server:

[root@localhost ]# service mysqld start 

Set the server to automatically start on boot:

[root@localhost ]# chkconfig mysql on 

Change the MySQL root user password

[root@localhost ]# mysqladmin -u root password 'changeMe' 

Test the MySQL installation.

Log in to the database:

[root@localhost ]# mysql -u root -p 

You should receive an output like this:

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 9
Server version: 5.1.73 Source distribution

Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights
reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input
statement.

mysql>

Type 'exit' to log out:

mysql> exit

PHP

To install PHP open a root command line and type:

[root@localhost ]# yum install php php-mysql

Create a simple test page to test the installation, by using your editor of choice:

[root@localhost ]# nano /var/www/html/test.php

Insert the following content:

<?php 
    phpinfo(); 
?>

Save and close.

Restart the web server:

[root@localhost ]# service httpd restart

Open http://localhost/test.php or http://your-server-address/test.php on your web browser of choice. You should receive a page like this:

Rsyslog

To install Rsyslog server, open a root command line and type:

[root@localhost ]# yum install rsyslog*

Start the server:

[root@localhost ]# service rsyslog start 

Set automatically start the server at boot time:

[root@localhost ]# chkconfig rsyslog on

Rename the Rsyslog database:

[root@localhost ]# nano /usr/share/doc/rsyslog-mysql-5.8.10/createDB.sql

From Syslog to rsyslogdb

CREATE DATABASE rsyslogdb; 
USE rsyslogdb; 
CREATE TABLE SystemEvents ( 
[...]

Create the rsyslogdb database:

[root@localhost ]# mysql -u root -p < /usr/share/doc/rsyslog-mysql-5.8.10/createDB.sql

Now you should be able to access the database:

[root@localhost ]# mysql -u root -p rsyslogdb

Create a dedicated user to access the Rsyslog database:

mysql> GRANT ALL ON rsyslogdb.* TO rsysloguser@localhost IDENTIFIED BY 'changeMe';
 
mysql> FLUSH PRIVILEGES;

mysql> exit

Test if you can access the database with the new user typing:

[root@localhost ]# mysql -u rsysloguser -p rsyslogdb

Configure the Rsyslog server in order to use MySQL.

Open the configuration file:

[root@localhost ]# nano /etc/rsyslog.conf

Uncomment the following modules:

$ModLoad imudp 
$UDPServerRun 514 

# Provides TCP syslog reception 
$ModLoad imtcp 
$InputTCPServerRun 514 

Add the MySQL module:

$ModLoad ommysql

Add the forwarding rule:

*.* :ommysql:127.0.0.1,rsyslogdb,rsysloguser,changeMe

where:

127.0.0.1 - mysql server address
rsyslogdb - mysql rsyslog database name
rsysloguser - mysql rsyslog database user username
changeMe - mysql rsyslog database user password

Save and exit.

Restart the Rsyslog server in order to load the new configuration:

[root@localhost ]# service rsyslog restart

You should be able to see the log entry in the database:

[root@localhost ]# mysql -u rsysloguser -p rsyslogdb

mysql> select count(*) from SystemEvents;
+----------+
| count(*) |
+----------+
|        2 |
+----------+

You should have a count number greater than ZERO. If not, wait a few seconds in order to let Rsyslog to generate log entries.


Hint:

To send a test message to the log:

[root@localhost ]# echo '<14>ip_address_here tag_here message here' | nc -v -u -w 0 127.0.0.1 514

LogAnalyzer

Download the latest version of the software (when this document was written, it was 3.6.5):

[root@localhost ]# wget http://download.adiscon.com/loganalyzer/loganalyzer-3.6.5.tar.gz

Unpack the tarball:

[root@localhost ]# tar zxvf loganalyzer-3.6.5.tar.gz

Copy installation files to the desired folder:

[root@localhost ]# cp -r loganalyzer-3.6.5/src/ /var/www/html/loganalyzer
[root@localhost ]# cp -r loganalyzer-3.6.5/contrib/* /var/www/html/loganalyzer/

Change directory to the installation folder:

[root@localhost ]# cd /var/www/html/loganalyzer/

Add the execution permission to the following files:

[root@localhost ]# chmod +x configure.sh secure.sh

Now run ./configure.sh. This will create a blank config.php, and will also set write access to everyone to it.

[root@localhost ]# ./configure.sh

To complete the installation open http://localhost/loganalyzer or http://your-server-address/loganalyzer on your web browser of choice. You should receive an error page like this:

Click on here link and start the guided installation process:

Step 1

Simply click Next to start the process.

Step 2

Simply click Next to continue the process.

Step 3

Enable the user database to secure the UI access and fill the fields accordingly

Step 4

Simply click Next to continue the process.

Step 5

Simply click Next to continue the process.

Step 6

Create a user in order to access the LogAnalyzer web interface. In the example we create a user admin/admin, fill the fields and click Next to continue the process.

Step 7

Create the first source for Syslog messages. Fill the fields and then click Next to continue the process.

Step 8

Simply click Next to continue the process. 


The installation is complete.

Step 9

Log in the web UI with the credentials created in Step 6

Step 10

Congratulations! You have successfully installed and configured your logging solution.

 

Install rsyslog package in your client systems.

For RHEl/CentOS Clients:

# yum install rsyslog -y

For Debian/Ubuntu Clients:

$ sudo apt-get install rsyslog

Open the rsyslog config file and the rsyslog server details.

# vi /etc/rsyslog.conf

Add Rsyslog server details:

*.*     @@192.168.54.102

and start rsyslog services.

# service rsyslog start 
# chkconfig rsyslog on

Now goto rsyslog server and check for client logs.

As you see in the above screenshot my client GitLab has been added and log details are shown in the LogAnalyzer admin console.

Troubleshooting

After login you may receive the error message:

could not find the configured table, maybe misspelled or the table names are case sensitive

This error is often due to wrong syntax in the DBTableName field. To fix it you need to edit the /var/www/html/loganalyzer/config.php file and check if the DBTableName value is written with the correct capital letters.

SystemEvents

# vi /var/www/html/loganalyzer/config.php

Amended the DBTableName value, the system should work properly.

Controlling User Access to Programs in Windows 7

Controlling User Access

magine this – you have multiple users in your family sharing the same computer and operating system. You don’t want other users of the shared computer to run each and every program that’s installed in Windows 7. Some of the programs which you have installed require knowledge, and you don’t want your kids and other shared members to tinker with the application settings or change the configurations.

The ability to run selected programs for selected users can be achieved in two ways:

1. Choose The User account during Installation of the Application.

2. Tweak the Group Policy Editor and manually Add the Programs which shared users can run

We will discuss both of the above methods in full detail.

Important Note: First make sure that only you have the administrator account and the shared users have a limited user account in Windows7. If one or more of the other user accounts have administrator privileges, he/she might override the settings and configurations which you will create below.

Choose The User account during Installation of the Application

Windows 7 comes with a very useful User Account Control feature which allows you to define which user accounts should have the permission to run a program, when the program is being installed. When you are installing a new application, you will see the following two options:

Install this application for anyone who uses this computer (all users).

Install this application only for me.

If you don’t want other users of your shared computer to use the program you are installing, simply select the radio buttonOnly For me.
That’s it, now only you will be able to use, customize or remove that specific program in Windows7; other shared users will see the following prompt, when they try to run the program from their user accounts:

You don’t have the required permissions to run or remove this Application. Please contact the system administrator

Tweak the Group Policy Editor and manually add the programs which shared users can run.

Note: This section of this tip only applies to Professional editions of Windows. That includes Windows XP Pro, Windows Vista Pro, and Windows 7 Pro. This will not work on Home editions.

If you have already installed all the applications in your computer and don’t want to reinstall them with necessary permissions, you can manually add the programs from the Windows7 Group Policy Editor.
Carefully follow the steps outlined below:

1. Click Windows 7 start menu and type gpedit.msc in the search box. When the search results appear, click the gpedit icon.

2. Clicking the gpedit icon will open Windows Group Policy Editor window.

3. In the left pane, navigate to User Configuration > Administrative Templates folder. You have to first click the small arrow placed next to the User configuration folder and then repeat the same thing for theAdministrative Templates subfolder

4. When you have reached the Administrative Templates subfolder, click the System subfolder on the left pane.

5. Now switch to the right pane and find the setting which says Run Only Specified Windows Applications.

The current setting for this key should be Not Configured, as shown below:

6. Right click that key and choose Edit

7. This will open a new window where you can define the programs and applications which will have the necessary user permissions.

When the window opens; first select the Enabled button at the top, as shown below:

8. Scroll down and hit the Show button next to List of allowed applications, this will open a small pop up window as shown below:

9. Now you have to type the name of the program which you want other users of the shared computer to be able to use. Type the name of all the common applications e.g. Word.exe, Excel.exe, Firefox.exe one by one in each of the following rows.

When you are done adding all the programs, hit the OK button. Next, hit the Apply button and close the Group Policy Editor window

That’s it, you have just defined the list of all the programs which other users of the same computer may use. Any program that’s not listed in the list of allowed applications will not have the necessary permissions and thus other users won’t be able to run it or entirely remove it from your computer.

Should you want to grant all users the ability to use all the programs installed on your computer, simply navigate to the above mentioned Group policy setting and disable the entire feature.

Basics of System Administration in Linux

Ubuntu 10.10

Objective 

adduser

sudo
su
sudo -i
usermod
userdel
id
du
df

Summary

 adduser command to create a new user account
 su command to switch from one user to another
 sudo -i  command to change root password 
 usermod command for changing the user account setting
 userdel command to delete the account
 id command to know the information about user ids and group ids
 df command to check the file system size and its availability
 du command to check the space occupied by a file



adduser
 
   The adduser command will create a new user login for us along with authentication
    we can add any user account with the help of sudo command

sudo

   sudo command allows the administrative user to execute a command as a super user.
   The sudo command has many options.

Su
 
   su stands for 'Switch User'
   This commands is useful in switching from current user to another user.




sudo -i

  sudo -i command which is user to change a root password




usermod
 
  usermod Enables a super user or root user to modify the setting of others
  user accounts:
       change the password to no password or empty password
       show the date on which the user
       account will be disabled



userdel

 we can delete the user account permanently with the help of  the userdel command



id

id command is used to check the identities of all the users and groups on the system
To know about the identity of the user, we use id -u
To know about the identity of the group users,it is id -g



df / du

 The df command gives a report on the free space available on the disk.
 The du command gives a report on how much space a file has occupied.