Linux Server-log (1)

BKJIA exclusive report] logs are very important for security. They record various events that occur in the system every day. You can use them to check the causes of errors, or the traces left by the attacker during the attack. The main functions of logs are audit and monitoring. It can also monitor the system status in real time, monitor and track intrusions, and so on. Because of this, fuqin makes it into an article that shares the same proportion with hardware and network articles. It is the third article in the series of "understanding your Linux Server, I hope you can learn something useful to yourself.

1. Configure sysloggyl4802959)

Currently, linux still uses syslogd as the log monitoring process. The necessary configuration can reduce a lot of trouble and monitor the system status more effectively from system logs. It is especially important for the system administrator to understand and improve the syslog configuration.
/Etc/syslog. conf defines the rule according to the following format: facility. level action
Device. The priority action facility. level field is also known as the seletor selection condition). The selection condition and action are separated by spaces or tabs.
# Comments start with "#". blank lines are automatically skipped.

1. facility

Facility defines the range of log messages. The keys used include auth-authentication activities reported by pam_pwdb. Authpriv-authentication activities including privileged information such as user names cron-scheduled task information related to cron and. Daemon-background process information related to the inetd daemon. Kern-kernel information is first transmitted through klogd. Lpr-information related to the print service. Mail-email-related information the mark-syslog internal function is used to generate the timestamp news-information from the news server syslog-information generated by syslog user-information generated by the user program uucp -Information local0-local7 generated by uucp-used with custom programs

* Wildcards indicate that all functions except mark are used internally, and security is defined as an old key, which is equivalent to auth and is no longer recommended.

2. level

Level defines the degree of urgency of a message. In the order of severity from high to low: emerg-the system is unavailable, equivalent to panicalert-conditions that need to be modified immediately crit-error conditions that prevent certain tools or subsystem functions from implementing err-error conditions that prevent the implementation of tools or some subsystem functions, equivalent to errorwarning-warning information, equivalent to warnnotice-important common condition info-message that provides information debug-Other information that does not contain function conditions or problems none-no importance level, usually used for troubleshooting

* All levels except none, panic, error, and warn are old identifiers and are not recommended.
When defining the level, pay attention to two points: 1) the priority is determined by the application programming. The priority of the message cannot be changed unless the source code is modified and compiled;

A low priority includes a high priority. For example, if you define the log orientation of info for an application, messages such as notice, warning, err, crit, alert, and emerg are included. Unless defined by "=)

3. selector Selection Conditions

Connect facility and level by the decimal point "." To become the selector selection condition ). You can use the Semicolon ";" to define multiple selection conditions at the same time. Three modifiers are also supported: *-all log information =-equal to, that is, only the log information of this priority is included! -Not equal to, except for the priority log information

4. action

The log information defined by the preceding conditions can be used to execute the following action: file-specify the absolute path of the log file terminal or print-send to the serial or parallel device identifier, for example, in the/dev/ttyS2 @ host-remote Log Server username-sending information window of the local machine, however, the user must have logged on to the system. named pipe-the absolute path sent to the FIFO file created by using the mkfifo command in advance. Note that the path cannot pass "|/var/xxx. sh is used to direct logs to other scripts for processing.

5. Example

Example :*. info; mail. none; news. none; authpriv. none; cron. none/var/log/messages # Write All notification messages except emails, news groups, authorization information, and scheduled tasks into the messages file. Mail, news. = info/var/adm/info # write only notification messages in emails and news groups to the info file. Other information is not written. Mail. *; mail .! = Info/var/adm/mail # Write all emails except notification messages to the mail file. Mail. = info/dev/tty12 # Send only the intellectual message of the email to the tty12 terminal device *. alert root, joey # If the root and joey users have logged on to the system, they will be notified of all emergency information *. * @ finlandia # direct all the information to the finlandia host and resolve the IP address through/etc/hosts or dns. Note: Each message passes through all rules, it is not a unique match.

That is to say, assume mail. = When the info information passes the rules defined in the preceding example, the/var/adm/info,/var/adm/mail,/dev/tty12, and even the finalandia host will receive the same information. This seems cumbersome, but the benefit is that it ensures the integrity of information and can be analyzed in different places.