Linux Rookie Entry System log

System log

1. System Default Classification

/var/log/messages system services and logs including service information error

/var/log/secure System Certification Information log

/var/log/maillog System Mail Service information

/var/log/cron System Timing Task Information

/var/log/boot.log System Boot Information

2. Log Management Service Rsyslog. Service

1.rsyslog collection of classification logs, not generated

2.rsyslog Log Classification

/ETC/RSYSLOG.CONF Master configuration file

* * Store files

service . Log Level/var/log/westos

Systemctl Restart Rsyslog to restart the Rsyslog service after modifying the configuration file

3. Log Analysis tool Journal

Systemd-journald Process Name

Journalctl direct execution, browse system log

Journalctl-n 5 Latest 5 article

Journalctl-p Err Display Error

Journalctl-f Monitoring log Generation =tail-f

Journalctl--since "Toda" yyyyy-mm-dd "" Hh:mm:ss ""--until ""

Journalctl-o verbose show detailed process parameters that the log can use

_systemd_unit=sshd.server Service Name

_pid Process PID

the management of Systemd-journald

By default, this program ignores log information before restarting, such as not ignoring , the operation is as follows

mkdir/\u52a1\u540d\u79f0

# #_PID =1182\u8fdb\u7a0bpid

4. Format

log device type . Log level log processing method

Auth PAM-generated logs

Authpriv ssh. Authentication information for FTP and other login information

Cron Time Task related

Kern kernel

LPR Printing

Mail message

Mark (syslog)-rsyslog service Internal information, time label

News Newsgroups

Related information generated by user program

UUCP related communication between UNIX to UNIX Copy,unix hosts

Local 1~7 custom log device

5. Log level

Debug information, the most log information

Info General Information Log, most commonly used

Notice information on the most important general conditions

Warning Warning Level

Err error level, information that prevents a feature or module from working correctly

Crit critical level that prevents the entire system or the entire software from working properly information

Alert requires immediate modification of the information

Emerg critical information such as kernel crashes

None records anything.

Note: From top to bottom, level from top to bottom, and less information is logged

detailed information can be viewed in the manual:man 3 syslog

6. Connection symbols

. XXX indicates information greater than or equal to XXX level

. =xxx represents information equal to XXX level

.！ XXX indicates level information outside of XXX

7. Example

1. Record to normal file or device file:

* */var/log/file.log

* */dev/pts/0

Logger-p Local3,info ' kadefor is testing the rsyslog and logger '

2. Send to User (need online to receive)

* * Root uses, number separates multiple users

* * ROOT,KADEFOR,UP01 * denotes all online users

*.* *

3. Ignore, Discard

local.* ~ ignores all levels of logs for all LOCAL3 types

4. Execute the Script

local3.* ^/tmp/a.sh ^ number followed by an absolute path to an executable script or program

8. Log Synchronization

Systemctl stop FIREWALLD shut down the firewall for two hosts

Log Sender

*. * @172.25.0.11 sends logs to 11 host @ UDP @ @tcp via UDP protocol

Log receiver

$ModLoad IMUDP Log Receive Plugin

$UDPServerRun 514 Log accepts plug-ins using ports,

9. Log Capture Format

$template Westos, "timegenerated%%fromhost-ip%%syslogtag%%msg%\n"

messages, add Westos.

This article is from the "12147236" blog, please be sure to keep this source http://12157236.blog.51cto.com/12147236/1863524

Linux Rookie Entry System log