Linux Basic Learning System log

1. System Log Default classification

   /var/log/messages system services and logs, including service information, error, etc.

/var/log/secure System Certification Information log

/var/log/maillog System Mail Service information
/var/log/cron System Timing Task Information
/var/log/boot.log System Boot Information

650) this.width=650; "title=" screenshot from 2017-10-16 22-18-48.png "alt=" Wkiol1nmbmpc-adxaaf6w80kja8889.png-wh_50 " src= "Https://s4.51cto.com/wyfs02/M02/A7/67/wKioL1nmBMPC-adxAAF6w80KJa8889.png-wh_500x0-wm_3-wmp_4-s_28710922.png"/>

1. Log Management Service Rsyslog

   1) Rsyslog is responsible for collecting logs and sorting logs

   2) Rsyslog Log classification

vim/etc/rsyslog.conf # #主配置文件

Service. Log level/storage file

* */var/log/westos

Systemctl Restart Rsyslog

650) this.width=650; "title=" screenshot from 2017-10-16 22-12-04.png "alt=" Wkiom1nmb7ni0rqzaak0qqppblq119.png-wh_50 " src= "Https://s2.51cto.com/wyfs02/M02/08/B7/wKiom1nmB7ni0rQzAAK0QQpPBlQ119.png-wh_500x0-wm_3-wmp_4-s_3447042020.png"/>

# # #格式 # #

Log device (type). (connection symbol) log-level log processing mode (action)

# # # #日志设备 (can be understood as a log type): # # #

Auth # #pam产生的日志

Uthpriv # #ssh, authentication information for login information such as FTP

Uthpriv # #ssh, authentication information for login information such as FTP

Kern # #内核

LPR # #打印

Mail # #邮件

Mark (syslog) –rsyslog # #服务内部的信息, Time ID

News # #新闻组

User # #用户程序产生的相关信息

UUCP # #unix to UNIX copy, related communication between UNIX hosts

Local 1~7 # #自定义的日志设备

# # # #日志级别 # #
Debug # #有调式信息的, maximum log information

Info # #般信息的日志, most commonly used

Notice # #最具有重要性的普通条件的信息

Warning # #警告级别

Err # #错误级别 Information that prevents a feature or module from working correctly

Crit # #严重级别 Information that prevents the entire system or the entire software from working properly

Alert # #需要立刻修改的信息

Emerg # #内核崩溃等严重信息

One # #什么都不记录

Note: From top to bottom, levels are low to high, with less information logged
# #详细的可以查看手册: Man 3 syslog

# # # # #实例 # #

Record to normal file or device file:

*./var/log/file.log Absolute Path

* */dev/pts/0

Send to user (need to be online to receive)

*. * Root

* * ROOT,KADEFOR,UP01 # Use, number to separate multiple users

* * * indicates all online users

3. Log synchronization

Systemctl Stop FIREWALLD # #关闭两台主机的火墙

Configuring the Log Sender

* * @172.25.0.11 # #通过udp协议把日志发送到11主机, @udp, @ @tcp

650) this.width=650; "title=" screenshot from 2017-10-16 22-51-24.png "alt=" Wkiom1nmcuqj8e2vaakx84q4nrk845.png-wh_50 " src= "Https://s4.51cto.com/wyfs02/M02/08/B7/wKiom1nmCUqj8E2vAAKx84q4nRk845.png-wh_500x0-wm_3-wmp_4-s_298441667.png"/>

To configure a log receiver

$ModLoad IMUDP # #日志接收插件
$UDPServerRun 514 # #日志接收插件使用端口

650) this.width=650; "title=" screenshot from 2017-10-16 22-53-03.png "alt=" Wkiom1nmcxjzullcaammpashgbw231.png-wh_50 " src= "Https://s5.51cto.com/wyfs02/M00/08/B7/wKiom1nmCxjzullcAAMMPAsHgbw231.png-wh_500x0-wm_3-wmp_4-s_1684420258.png"/>

Test

>/var/log/messages # #两边都作

Logger Test Message # #日志发送方

650) this.width=650; "title=" screenshot from 2017-10-16 23-40-51.png "alt=" Wkiom1nmczsjuwh-aailvve3ipi388.png-wh_50 " src= "Https://s4.51cto.com/wyfs02/M01/08/B7/wKiom1nmCzSjuwh-AAIlVVE3IPI388.png-wh_500x0-wm_3-wmp_4-s_3630692231.png"/>

Tail-f/var/log/message # #日志接收方

650) this.width=650; "title=" screenshot from 2017-10-16 23-16-08.png "alt=" Wkiol1nmcnxrrewqaaobl2dubt4579.png-wh_50 " src= "Https://s2.51cto.com/wyfs02/M00/A7/67/wKioL1nmCNXRrEwqAAOBl2dUBt4579.png-wh_500x0-wm_3-wmp_4-s_3870561665.png"/>

4. Log Capture format

$template Westos, "%timegenerated%%fromhost-ip%%syslogtag%%msg%\n"

%timegenerated% # #显示日志时间
%fromhost-ip% # #显示主机ip
%syslogtag% # #日志记录目标
%msg% # #日志内容
\ n # #换行

Log Analysis Tool

Journal

Systemd-journald # #进程名称

Journalctl # #直接执行, browse the system log
-N 3 # #显示最新3条
-P Err # #显示报错
-F # #监控日志
--since--until # #--since "[YYYY-MM-DD] [HH:MM:SS]" from what time to what time of the log
-O Verbose # #显示日志能够使用的详细进程参数
# #_SYSTEMD_UNIT =sshd.service Service Name
# #_PID = 1182 Process PID

650) this.width=650; "title=" screenshot from 2017-10-17 00-04-34.png "alt=" Wkiol1nmcw-zt57oaaribvbfkcm838.png-wh_50 " src= "Https://s5.51cto.com/wyfs02/M01/A7/67/wKioL1nmCW-zt57oAARIbvBFkCM838.png-wh_500x0-wm_3-wmp_4-s_3600698730.png"/>

650) this.width=650; "title=" screenshot from 2017-10-16 23-43-58.png "alt=" Wkiom1nmdd3hkwogaaweqvrdghg979.png-wh_50 " src= "Https://s3.51cto.com/wyfs02/M00/08/B7/wKiom1nmDD3hKWoGAAWeqVrDGhg979.png-wh_500x0-wm_3-wmp_4-s_2745165026.png"/>

Management of Systemd-journald

By default, this program ignores log information before restarting, such as not ignoring:
Mkdir/var/log/journal
Chown root:systemd-journal/var/log/journal
chmod 2755/var/log/journal
Killall-1 Systemd-journald
ls/var/log/journal/4513ad59a3b442ffa4b7ea88343fa55f
System.journal user-1000.journal

5. Time synchronization

1) vim/etc/chrony.conf # #主配置文件
# Allow NTP Client access from the local network.
Allow 172.25.0.0/24 # #允许谁去同步我的时间
# Serve Time even if not synchronized to any NTP server.
Stratum local #不去同步任何人的时间, time synchronization server level

Systemctl Restart Chronyd
Systemctl Stop Firewalld

650) this.width=650; "title=" screenshot from 2017-10-17 17-56-24.png "alt=" Wkiol1nmccms5y4maaruoevtooi176.png-wh_50 " src= "Https://s1.51cto.com/wyfs02/M02/A7/67/wKioL1nmCcmS5Y4MAARUoEVTOOI176.png-wh_500x0-wm_3-wmp_4-s_585001055.png"/>

2) Client

Vim/etc/chrony.conf

3 Server 0.rhel.pool.ntp.org Iburst
4 server 1.rhel.pool.ntp.org iburst====> server Ntpserverip iburst
5 server 2.rhel.pool.ntp.org iburst====>
6 Server 3.rhel.pool.ntp.org Iburst

Systemctl Restart Chronyd

650) this.width=650; "title=" screenshot from 2017-10-17 18-00-45.png "alt=" Wkiom1nmdbeatqokaaqi07ky9vk504.png-wh_50 " src= "Https://s4.51cto.com/wyfs02/M01/08/B7/wKiom1nmDbeATqOkAAQi07KY9vk504.png-wh_500x0-wm_3-wmp_4-s_3128581864.png"/>

3) Testing

[Email protected] ~]# Chronyc sources-v

650) this.width=650; "title=" screenshot from 2017-10-17 18-05-26.png "alt=" Wkiol1nmczuzqhrmaantebfot0q496.png-wh_50 " src= "Https://s2.51cto.com/wyfs02/M00/A7/67/wKioL1nmCzuzQhRMAANTEbFOt0Q496.png-wh_500x0-wm_3-wmp_4-s_2100655802.png"/>

6.timedatectl command

Timedatectl Status # #显示当前时间信息

650) this.width=650; "title=" screenshot from 2017-10-17 18-07-17.png "src=" https://s3.51cto.com/wyfs02/M01/08/BB/ Wkiom1nmlgbtetbnaai4frxu3pc380.png-wh_500x0-wm_3-wmp_4-s_2278558753.png "alt=" Wkiom1nmlgbtetbnaai4frxu3pc380.png-wh_50 "/>

650) this.width=650; "title=" screenshot from 2017-10-17 18-16-57.png "src=" https://s3.51cto.com/wyfs02/M00/A7/6B/ Wkiol1nmk4kq4dfeaahv8dham_w543.png-wh_500x0-wm_3-wmp_4-s_3986642605.png "alt=" wKioL1nmk4KQ4dFeAAHV8DHAM_ W543.png-wh_50 "/>

Set-time # #设定当前时间
Set-timezone # #设定当前时区
SET-LOCAL-RTC 0|1 # #设定是否使用utc时间

Linux Basic Learning System log