Linux Log Module

The logging function is provided by the specific Daemon syslog. If the software suite needs to be written to the log file managed by syslogd, the software package must support the write mode of syslogd login files.

The log information is stored in the/var/log directory. The syslog configuration file is/etc/syslog. conf, which sets auth, authpriv, cron, daemon, kern, lpr, mail, news, syslog, user, uucp, local0-local7 where these service categories correspond to seven levels of information (info, notice, warn, error, crit, alert, emerge,) Where log files are placed, in addition, there is a special level of none that does not need to be recorded for any level.

There are three symbols before the level to describe the level [. = !] [.] Indicates that the DoT number is greater than the information level (including itself). [. =] indicates that the DoT number can only be equal to the information level. [.!] Indicates that all levels except this level are recorded.

This can be set when multiple hosts need to summarize records on one host.

Server: the service uses UDP port 514. Therefore, the Service port must be opened.

First, make sure that UDP 514 corresponds to syslog in/etc/services, then, modify the/etc/sysconfig/syslog STARTUP script to allow it to support remote transmission, that is, add the-r option, restart the syslog daemon, and use netstat to ensure that the port is opened.

On the client side, you only need to modify the configuration file of syslog. conf to specify the server address to be transferred.

*. * @ Server IP Address

/Etc/syslog. conf records the location where logs are stored, and/etc/sysconfig/syslog records the startup script program.

The larger the log file, the lower the log write efficiency. Therefore, it is necessary to rotate the log into several small files. The configuration file of the file rotation function is recorded in the/etc/logrotate. conf file. The configuration information under the/etc/logrotate. d directory is read in the file. /Etc/logrotate. d is actually composed of/etc/logrotate. conf: Separate a directory to avoid reading logrorate. conf file, resulting in too complex,/etc/logrotate. d mainly stores the setting information of the server login file created by the rpm package. /Etc/logrotate. d/syslog sets how logs rotate. The Logrotate-v configuration file allows you to view rotation information. The logrotate-f configuration file is forcibly rotated once.

Last, lastlog, and dmesg can view recent logon information.