Linux Beginner-System log (i)

Linux Beginner-System log (i)

The system log can record the operating state of the system, and if it fails, it will indicate the wrong location. Therefore, it is necessary to understand and learn the system log.

1. Default classification of system logs

The system log is recorded by default in the following address, with different logs in different files.

/var/log/messages system services and logs, including service information, error, etc.

/var/log/secure System Certification Information log

/var/log/maillog System Mail Service information

/var/log/cron System Timing Task Information

/var/log/boot.log System Boot Information

2. Rsyslog Service

The Rsyslog service is responsible for collecting and classifying logs, and does not process the logs. Change the Rsyslog configuration file can change the log storage and classification standards, command for "vim/etc/rsyslog.conf". As shown, enter "*./var/log/test" to indicate that all types and levels of logs are stored under the directory "/var/log/test".

3, the synchronization of the log

Sometimes you need to enter a host's log into another host, which requires the synchronization of the log function.

The log sender is configured by entering the command "vim/etc/rsyslog.conf", in which "*. * @172.25.254.102" is added, indicating that all logs are sent to the UDP protocol on this host with IP 172.25.254.102.

After saving, enter "Systemctl restart Rsyslog" to restart the Rsyslog service.

The log receiver is configured by entering the command "vim/etc/rsyslog.conf" and deleting # on lines 15th and 16th so that the log receive plug-in "$ModLoad imudp" and the log receive plug-in use the port "$UDPServerRun 514" to lighten.

Restart the Rsyslog service after exiting the save.

Enter "Systemctl stop Firewalld" To turn off the firewall.

The systemctl restart Sshd.server command is executed on the log sender during the test, and the log that restarts the SSH service appears under the "/var/log/messages" file of the log receiver.

Linux Beginner-System log (i)