Linux under the log system detailed

Linux under the log system details

Two Log service syslog and syslog-ng on 1.linux system

Syslog service has two processes syslogd and KLOGD

SYSLOGD: System-generated log information

KLOGD: Log information generated by the kernel

KLOGD: Kernel generates log output to physical terminal (/dev/console) and puts it into/VAR/LOG/DMESG file at system boot

Viewing the log information generated by the KLOGD can be viewed through the DMESG and CAT/VAR/LOG/DMESG commands

SYSLOGD: After the system starts, the log is generated by each subsystem and put to

/var/log/messages: Most log information except kernel log information;

/var/log/maillog: Log information generated by the mail system;

/var/log/secure: Security-related logs, such as user login, etc.

2.syslog configuration file in/etc/syslog.conf

The Write format is: log source . Level store Path

The log sources are as follows:

Auth # Certification

Authpriv # permissions, Authorization

Cron # Task Scheduler

Daemon # daemon

Kern # kernel

LPR # Print

Mail # messages

Mark # mark

News # Press

Security # Secure

Syslog # syslog itself

User # users

UUCP # Transferring files between UNIX systems

Local0 to Local7 # User definable

* # All the log sources

level : Below from low to high

Debug # program or system debug information

Info # General Information

Notice # does not affect the normal function, need to note the message

Warning/warn # may affect system functionality, but need to remind users of important events

Err/error # error message

Crit # more serious.

Alert # must be dealt with immediately

Emerg/panic # Panic can cause system crashes

* # indicates all log levels

None # is the opposite of *, which means not showing

Storage Path :

Absolute path # Ordinary files such as:/var/log/messages

| # pipelines are routed to other command processing

Terminal # Terminals such as:/dev/console

@HOST # remote host such as: @172.16.1.1

User # System user such as: root

* # Log on to all users on the system, such as Emerg system default definition

3. For example:

Mail.info/var/log/mail.log # indicates that the mail level is information above the info and info levels

Auth.=info @172.16.1.1 # indicates that information for auth info is logged to the 172.16.1.1 host user.! =error/var/log/messages # Indicates a record of user-related information, excluding the error level

user.! Error/var/log/messages # will user.error the following levels of information

*.info/var/log/messages # indicates the info level for logging all log information

Mail.*/var/log/mail.log # Indicates that information is logged at all levels of mail

*. */var/all.log # All level information for all log sources

Cron.info;mail.info//var/log/mail.log # Multiple log sources can be separated by ";"

Cron,mail.info/var/log/mail.log # Same as Cron.info;mail.info function

mail.*;mail.! =info/var/log/mail.log # indicates mail all information except info level

4. Logs require a rolling cut: how big or how long the log file is cut, deleted, or created

Configuration files are stored to/etc/logrotate.conf and/etc/cron.daily/logrotate scheduled tasks are performed daily

650) this.width=650; "src=" http://s5.51cto.com/wyfs02/M02/7F/BA/wKioL1cq0V7T7GztAAJrq_lq9e4384.jpg "title=" syslog "alt=" Wkiol1cq0v7t7gztaajrq_lq9e4384.jpg "/>

5. Deploy a log remote server:

/etc/rc.d/init.d/syslog Service script configuration file in/etc/sysconfig/syslog

Vim/etc/sysconfig/syslog syslogd_options= "-M 0" to syslogd_options= "-M 0- R"

This article is from the "Xavier Willow" blog, please be sure to keep this source http://willow.blog.51cto.com/6574604/1770366

Linux under the log system detailed