Linux system logs and rsyslog Service

Linux system logs and rsyslog Service
A log is a plain text file/var/log used by the system to record some related messages during system operation. It stores a large number of plain text log files to maintain the running status of related programs., error message. To analyze system running errors, use 1. kernel Message 2. service Message 3. application message this article will only involve saving logs and recording rsyslog is an enhancement of the old syslog version. You can view the current status through service rsyslog status and control rsyslog service viewing through service rsyslog start/stop/restart. generally, use the tail command to view the last 10 lines of logs (latest) you can also use tail-f to update/etc/rsyslog in real time. conf is the configuration file format of rsyslog XXX. YYY/var/filename XXX is the log source. YYY is the priority, for example, kern. the error/var/kern_error configuration adds a minus sign (minus sign) before the kernel error is written to the specified file path, which improves the write efficiency, but may cause cache loss during power failure, such as kern. error-/var/kern_error you can also write the path as @ 192.168.1.1 and send it to the log server. @ indicates UDP and @ indicates TCP is recommended to use TCP Facility-log SOURCE Facility message source kern kernel message user level message mail system message daemon kernel message auth authentication system message syslog log system message lpr print system message authpriv permission system message cron scheduled task message news system message uucp system message ftp service Message Priority/Severity LevelEmergency the system is no longer available Alert must immediately handle Critical severe Error Warning Notice normal information, however, the more important information is the normal information of Informational. Debug debug information/the log file in var/log records the message file name and records the message boot. log start message secure User Switch logon related message messages normal message dmesg kernel message messages normal message