Linux Learning Summary (29) System log

The system log records all kinds of things that happen every day, such as checking the system condition, detecting the starting condition of the service, the user's landing situation and so on. We can use the log to find out the cause of an error or trace the clues left by the attacker.

1/var/log/messages

It is the core system log file that contains boot information when the system starts, and other state information when the system is running. I/O errors, network errors, and other system errors are recorded in this file. Like what
A person's identity switch to root, as well as the user-defined software (Apache) logs are also recorded here.
The log file is the first file to be checked for troubleshooting. Many of the application status information to be recorded here, in order to let us find convenient, the system started a log polling mechanism, each week to switch a log, after the switch log name is similar to messages-20170322, will be stored in the/var/log/directory, There are altogether 5 such log files along with the message. Here 20170322 is the identification date of the cutting log, implemented by the Logrotate tool, and its configuration file is/etc/logrotate.conf
Look at the message file first

/var/log/message is rsyslogd generated by this daemon, and if the service is stopped, the system will not generate the log, so the service does not stop. The configuration file for the RSYSLOGD service is /etc/rsyslog.conf . This file defines the level of the log. The file should not be modified easily.

2 DMESG

This command can display the system boot information, such as your hard disk or network card has a problem, with this command can be seen,
You can try to dmesg |grep error find the corresponding record. The print information is not recorded in the log and is only present in the current memory.

3 Security Log

lastThe command is used to view historical information about the login Linux, as follows:
Last |head

From left to right: account name, landing terminal, login client IP, login date, log out time, resident length.
The output information for this command actually reads the binary file/var/log/wtmp, which of course cannot be viewed directly with cat.
/var/log/secureIt is also a log file associated with the login information. This file records authentication and authorization information. When the SSH login system succeeds or fails, the relevant information will be recorded here.
In the future to develop the habit of viewing the log at any time, such as when Apache failed to start, it can be more log lookup reasons.

4 Xargs and Exec

Both of these can replace the output of a command, and exec is primarily a find together with the use.
Xargs is used as a replacement tool to read input data after reformatting the output

echo "hello ,world" > a.txtls a.txt |xargs cat

If the command that follows the Xargs has a double option, the-i option is used, as in the following example:
find ./ -name "*txt" |xargs -i mv {} b.txt

EXEC app
Find files with current directory creation time greater than 10 days and delete
find ./ -mtime +10 -exec rm -rf {} \;
To change file names in bulk:

5 Screen Tool

In order not to accidentally interrupt a task
nohup command &
Screen is a virtual terminal
Yum install-y screen no words to install
Screen directly enter into the virtual terminal
Ctral a combo key and press D to exit the virtual terminal, but not the end
Screen-ls viewing the virtual terminal list
Screen-r ID Enter the specified terminal, exit the virtual terminal with exit
Screen-s LV Specify name create a virtual terminal
Screen-r LV Login with Name

Linux Learning Summary (29) System log