Linux Log Management

Source: Internet
Author: User
Tags syslog system log rsyslog

A log is a historical event used to record the state of a system's operation, primarily recording events that occur at a particular time, and, depending on the log level, the critical program of the event, often called LogLevel.

System Log Service
syslog:    系统级别:syslogd    内核级别:klogdrsyslog特点:    多线程:    UDP,TCP,SSL,TLS协议    支持MySQL, PGSQL,ORACLE日志存储    强大的过滤器,可实现过滤日志信息中任何部分    自定义输出格式Elasticsearch分布式日志,logstash日志,kibans = ELK
Log Collection Party
facility:设施,从功能或程序上对日志进行分类    auth,authpriv,cron,daemon,kernel,lpr,mail,mark,news,security,user,uucp,local0-local7,syslogpriority:日志级别    debug,info,notice,warning,error,critical,alert,emergy 指定级别:    *:所有级别    none:没有级别    priority:此级别及更高级别的日志信息    =priority:此级别facility.prority /var/log/messages
Program Environment
主程序:rsyslogd配置文件:/etc/rsyslog.conf    kern.* /dev/console(内核日志记录在终端输出,可以用dmseg)    *.info;mail.none;authpriv.none;cron.none    /var/log/messages(除了mail,authpriv,cron之外所有的日志记录在messages文件中)    mail.*    -/var/log/maillog(-表示异步写入)    uucp,news.crit  /var/log/spooler(表示uucp和news同级别crit记录在spooler文件中)    local2.*  /var/log/sshd.log  (自定义,如把/etc/ssh/sshd_conf中的SyslogFacility local2在/etc/rsyslog.conf定义local2.* /var/log/sshd.log,这样ssh登陆的log记录在sshd.log中)
rsyslog.conf syntax
RULES:    facility.priority target    target:        文件路径:记录于指定的日志文件中,通常应该在/var/log目录下;        用户:将日志通知给指定用户: *指所有用户        日志服务器:@host            host:必须要监听在tcp或udp协议514端口上提供服务        管道:|COMMAND
Log format
    事件产生的日期时间 主机 进程(pid) 事件内容    某些日志记录是进进制格式:(last,lastb,lastlog)        /var/log/wtmp:当前系统上成功登陆的日志(last指令查询)        /var/log/btmp:当前系统上失败的登录尝试(lastb指令查询)        lastlog命令:显示当前系统每一个用户最近一次的登陆时间
Rsyslog Server
# Provides UDP syslog reception$ModLoad imudp$UDPServerRun 514# Provides TCP syslog reception$ModLoad imtcp$InputTCPServerRun 51以上配置同时启动TCP和UDP
Rsyslog Client Configuration
@IP (用UDP协议发送log到服务器)@@IP(用TCP协议发送log到服务器)

Linux Log Management

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.