Linux log System

Log system on Linux

Syslog

Syslog-ng:

Syslog Service:

SYSLOGD: System, non-kernel generated information

KLOGD: Kernel, specifically responsible for recording the log information generated by the kernel

Logs need to be scrolled (log cut):

Messages Messages.1 messages.2 messages.3 can scroll once a week or define how many m to scroll later

/sbin/init

/var/log/messages: Quasi-error log, non-kernel-generated boot information, information generated by each subsystem

/var/log/maillog: Mail log information

/var/log/secure: User Login information

Logrotate log Scrolling definition

/etc/logrotate Defining log scrolling files

/etc/logrotate.d/Defining log scrolling files

Syslog klogd/etc/syslog.conf configuration file

/etc/rc.d/init.d/syslog

/etc/sysconfig/syslog Modify file +r can be a log server

The configuration file definition format is: facility.priority action

facility, which can be understood as the source of the log or device currently used by facility, has the following types:

Auth # Certifications related to

Authpriv # permissions, authorization-related

Cron # Tasks related to scheduling

Daemon # daemon-related

Kern # kernel-related

LPR # Print related

Mail # message-related

Mark # tags related to

News # Related

Security # Safety-related, similar to auth

Syslog # Syslog's Own

User # users-related

UUCP # UNIX to UNIX CP related

Local0 to Local7 # user-defined use

* # * means all the facility

The level of the priority log levels, which generally have the following levels (from low to high)

Debug # Debugging information for a program or system

Info # General Information

Notice # does not affect the normal function, need to note the message

Warning/warn # may affect system functionality and need to alert users of important events

Err/error # error message

Crit # more serious.

Alert # must be dealt with immediately.

Emerg/panic # will cause the system to be unavailable

* # indicates all log levels

None # is the opposite of *, it means nothing.

Location of the action (action) log record

Absolute path on system # Normal file such as:/var/log/xxx

| # pipelines are routed to other command processing

Terminal # Terminals such as:/dev/console

@HOST # remote host such as: @10.0.0.1

User # System user such as: root

* # Log on to all users on the system, general Emerg level logs are defined like this

Examples of defining formats:

Mail.info/var/log/mail.log # indicates mail-related, level info, and

# Info above level information is recorded in the/var/log/mail.log file

Auth.=info @10.0.0.1 # indicates that auth related, basic info information is recorded to the 10.0.0.1 host.

# If 10.0.0.1 is going to be able to receive log messages from other hosts

user.! =error # Indicates a record of user-related information, excluding the error level

user.! Error # Contrary to User.error

*.info # indicates the info level for logging all log information

Mail.* # indicates that all levels of information related to mail are logged

* * * you know that.

Cron.info;mail.info # Multiple log sources can be separated by ";"

Cron,mail.info # and Cron.info;mail.info is a meaning

mail.*;mail.! =info # represents all levels of information related to mail, but does not include the info level

This article is from the "Stongerlinux" blog, make sure to keep this source http://strongerlinux.blog.51cto.com/9778871/1618853

Linux log System