Core Architecture Overview

Deploy Linux’s built-in rsyslog as the primary log collection and forwarding layer, pair it with a MySQL-compatible database for structured log storage, use rsyslog templates to organize raw text logs in to a year/month/day directory tree with client IP-based filenames, and leverage LogAnalyzer for web-based log visualization.

Implementation Workflow

1. Configure rsyslog server components
2. Set up a LAMP/LEMP-adjacent stack with Apache, MySQL/MariaDB, PHP
3. Deploy LogAnalyzer web interface
4. Enforce basic web access controls

Configure rsyslog Server

Start by editing /etc/rsyslog.conf to enable required modules, network listeners, database output, and dynamic text log templates. Use the following filtered configuration snippet (adjust database credentials, paths, and ports as needed):

# Load core and network modules
module(load="imuxsock") # local system logging via logger
module(load="imklog")   # kernel logging
module(load="immark")   # periodic MARK messages
module(load="imudp")
input(type="imudp" port="514")
module(load="imtcp")
input(type="imtcp" port="514")

# Load MySQL output module
module(load="ommysql")

# Dynamic text log template
$template DailyHostLogs,"/srv/log/remote-hosts/%$YEAR%/%$MONTH%/%$DAY%/%fromhost-ip%-syslog.log"

# Forward all logs to both dynamic file and MySQL
*.* ?DailyHostLogs
*.* :ommysql:127.0.0.1,rsyslog_db,rsyslog_writer,SecurePass123!

# Default local logging rules
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log

Apply chenges and verify:

# Restart and enable rsyslog
systemctl restart rsyslog
systemctl enable rsyslog

# Check active network listeners
ss -tulpn | grep 514

# Test local log generation
logger "central_log_test_$(date +%s)"

# Validate test message appears locally
journalctl -xe --unit=rsyslog --since "1 minute ago" | grep central_log_test
# Ignore temporary MySQL connection errors if DB isn’t set up yet

Note: Rsyslog configuration syntax varies across major versions (legacy $-prefixed vs. modern RainerScript). Use rsyslogd -v to check your version and /var/log/messages for runtime errors.

Set Up LAMP Stack Components

Install Apache, MariaDB (drop-in MySQL replacement), and required PHP extensions:

# CentOS/RHEL 7/8 compatible (adjust for other distros)
yum install -y httpd mariadb-server mariadb php php-mysqlnd php-gd gd gd-devel

# Start and enable services
systemctl start httpd mariadb
systemctl enable httpd mariadb

# Secure MariaDB installation (create root password, remove test DB, etc.)
mysql_secure_installation

# Create rsyslog database and user
mysql -u root -p

Run these SQL commands inside the MariaDB shell:

CREATE DATABASE rsyslog_db CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'rsyslog_writer'@'localhost' IDENTIFIED BY 'SecurePass123!';
GRANT ALL PRIVILEGES ON rsyslog_db.* TO 'rsyslog_writer'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Enable PHP GD warnings ignore by editing /etc/php.ini (uncomment and set value):

gd.jpeg_ignore_warning = 1

Restart Apache to apply PHP changes:

systemctl restart httpd

Deploy LogAnalyzer Web Interface

Download and extract the latest stable LogAnalyzer package, then set up the web directory:

cd /tmp
wget https://download.adiscon.com/loganalyzer/loganalyzer-4.1.12.tar.gz
tar xzf loganalyzer-4.1.12.tar.gz
cd loganalyzer-4.1.12

# Copy source files to Apache web root
mkdir -p /var/www/html/log-viewer
rsync -av src/* /var/www/html/log-viewer/

# Create and set permissions for config file
 touch /var/www/html/log-viewer/config.php
 chown apache:apache /var/www/html/log-viewer/config.php
 chmod 660 /var/www/html/log-viewer/config.php

Proceed with web-based installation by navigating to http://<server-ip>/log-viewer. Follow the wizard to connect to rsyslog_db, create required tables, and configure log sources. Remember to revert config.php permissions to 640 after installation completes.

Enforce Basic Web Access Controls

Use Apache’s HTTP Basic Authentication to restrict access:

1. Enable .htaccess overrides in Apache’s configuration. Edit /etc/httpd/conf/httpd.conf and set AllowOverride All for the /var/www/html directory block.
2. Create a .htaccess file in /var/www/html/log-viewer:

AuthName "Central Log Viewer Access Required"
AuthType Basic
AuthUserFile "/etc/httpd/.logviewers"
Require valid-user

3. Create the password file and add an initial user:

# Create file and first user (-c creates new file, omit -c for additional users)
htpasswd -c /etc/httpd/.logviewers admin_user
# Set secure permissions
chown root:apache /etc/httpd/.logviewers
chmod 640 /etc/httpd/.logviewers

4. Restart Apache to apply changes:

systemctl restart httpd

Example Client rsyslog Configuration

To forward logs from a remote Linux client, add these lines to its /etc/rsyslog.conf or a new /etc/rsyslog.d/10-forward.conf file:

# Forward all logs to central server via UDP and TCP
*.* @192.168.1.213:514
*.* @@192.168.1.213:514

# Optional: Forward specific local application logs
module(load="imfile" PollingInterval="8")
input(type="imfile"
    File="/var/log/nginx/access.log"
    StateFile="/var/spool/rsyslog/nginx-access-state"
    Tag="nginx-access"
    Severity="info"
    Facility="local6")
local6.* @@192.168.1.213:514

Restart the client’s rsyslog service to apply changes.