Basic Linux Learning (ix)

# #系统日志 # #

**1. System Log Default classification

/var/log/messages # #系统服务及日志, including service information, error, etc.

/var/log/secure # #系统认证信息日志

/var/log/maillog # #系统邮件服务信息

/var/log/cron # #系统定时任务信息

/var/log/boot.log # #系统启动信息

**2. Log Management Service Rsyslog

1.rsyslog is responsible for collecting logs and classifying storage logs

2.rsyslog Log Classification

vim/etc/rsyslog.conf # #主配置文件

Service. Log level/storage file

* */var/log/westos

Systemctl Restart Rsyslog

# #格式 # #

Log device (type). (connection symbol) log-level log processing mode (action)

# #日志设备 (can be understood as log type): # #

Auth # #pam产生的日志

Authpriv # #ssh, authentication information for login information such as FTP

Cron # #时间任务相关

Kern # #内核

LPR # #打印

Mail # #邮件

Mark (syslog)-rsyslog # #服务内部的信息, Time ID

News # #新闻组

User # #用户程序产生的相关信息

UUCP # #unix to UNIX Copy,unix host related communication

Local 1-7 # #自定义的日志设备

# #日志级别 # #

Debug # #有调试信息的, maximum log information

Info # #一般信息的日志, most commonly used

Notice # #最具有重要性的普通条件的信息

Warning # #警告级别

Err # #错误级别 Information that prevents a feature or module from working correctly

Crit # #严重级别 Information that prevents the entire system or the entire software from working correctly

Alert # #需要立即修改的信息

Emerg # #内核崩溃等严重信息

None # #什么都不记录

# #注意: From top to bottom, levels are low to high, and less information is recorded

# #详细可查看手册: Man 3 syslog

# #连接符号 # #

. XXX: Indicates information greater than or equal to XXX level

. =XXX: Represents information equal to XXX level

.! XXX: Information indicating the level outside of xxx

# #实例 # #

1. Record to normal file or device file:

* */var/log/file.log # #绝对路径

* */dev/pts/0

Test: Logger-p local3.info ' kadefor is testing the rsyslog and logger ' logger command to generate a new log

2. Send to User (need online to receive)

*. * Root

* * ROOT,KADEFOR,UP01 # #使用逗号分隔多个用户

* * * # * denotes all online users

3. Ignore, Discard

local3.* ~ # #忽略所有local3类型的所有级别的信息

4. Execute the Script

local3.* ^/tmp/a.sh # # ^ followed by an absolute path to an executable script or program

# #日志内容可以作为脚本的第一个参数

# #可用来触发警报

# #日志同步 # #

Systemctl Stop FIREWALLD # #关闭两台主机的火墙

Configuring the Log Sender

* * @172.25.0.11 # #通过udp协议把日志发送到11主机, @udp, @ @tcp

Configure the Log Receiver

$Modload IMUDP # #日志接收插件

$UDPServerRun 514 # #日志接收插件使用端口

650) this.width=650; "Src=" Http://s1.51cto.com/wyfs02/M02/89/19/wKiom1gHVzDgJOfeAAVWlFD_WJ4997.png-wh_500x0-wm_3 -wmp_4-s_1979710456.png "title=" 2016-10-19 15_11_15 screenshot. png "alt=" wkiom1ghvzdgjofeaavwlfd_wj4997.png-wh_50 "/>

Netstaut-anulpe | grep rsyslog

>/var/log/messages # #两边都做

Logger Test Message # #日志发送方

Tail-f/var/log/message # #日志接收方

# #日志采集格式 # #

$template your name in this format, "%timegenerated%%fromhost-ip%%syslogtag%%msg%\n"

$ActionfileDefaultTemplate your name in this format

*.info;mail.none;authpriv.none;cron.none/var/log/messaages; Your name in this format

# #日志分析工具journal # #

Systemd-journald # #进程名称

Journalctl # #直接执行, browse the system log

-N 3 # #显示最新3条

-P Err # #显示报错

-F # #监控日志

--since--until ##--since "[YYYY-MM-DD] [HH;MM;SS]" from what time to what time

-O Verbose # #显示日志能够使用的详细进程参数

# #_SYSTEMD_UNIT =sshd.service Service Name

# #_PID = 1182 Process PID

Basic Linux Learning (ix)