Rh124-log Linux Logs

Course Notes

#日志目录 [[email protected] log]$ Ls/var/log/amanda cron-20170531 glusterfs Messages #日志管理服务 [[EMAIL&NB Sp;protected] log]$ systemctl is-active rsyslog.service active# Log service configuration file [[email protected] log]$ cat/etc/ rsyslog.conf # Rsyslog configuration file#### MODULES # # # # # # # # # # # # # # # #加载模块列表 GLOBAL Directives # # #全局指令 # # # Uthpriv file has restricted access.authpriv.*/var/log/secure# description: Authpriv. For event name (System built-in event), authpriv.* * For the level,/var/log/secure for the event corresponding to the directory # Synchronous and unsynchronized # Log all of the mail messages in one place.mail.*-/var/log/maillo G#-/var/log/maillog-represents non-synchronous. No-is synchronous, yes-non-synchronous (comparing memory consumption). #emerg severity level, omusrmsg advertise all users # everybody gets emergency messages*.emerg:omu srmsg:* #journalctl View Log [[email protected] yuq]# journalctl-f #查看最后10条 [[email protected] yuq]# journalctl-p Emerg #查看emery级别日志 [[email protected] yuq]# journalctl-p err #查看err级别日志 [[email protected] yuq]# JournalCTL--since "18:00:00" #查看18点整以来的日志 [[email protected] yuq]# journalctl--since "17:00:00"--until "21:00:00" # View 17 o'clock full to 19 o'clock full log # Log sync to log server local5.info@192.168.26.140 # 192.168.26.200 configuration local5.info/var/log/yyy # 192.168.26.140 configuration [[ Email protected] yuq]# systemctl restart Rsyslog.service #重启服务 #192.168.26.140 configuration turn on remote log receive: Cat/etc/rsyslog.conf # Remote udp# provides UDP syslog reception$modload imudp$udpserverrun 514# remote tcp# provides TCP syslog reception$modload imtcp$In Puttcpserverrun 514# Different server logs stored in different files (192.168.26.140 configuration): Fromhost,isequal, "station1.rhce.cc"/var/log/station1: Fromhost,isequal, "station1.rhce.cc" ~ # ~: So far, does not match down, does not add this line of logs will match write/var/log/messages:fromhost,isequal, " station2.rhce.cc "/var/log/station2*.info;mail.none;authpriv.none;cron.none/var/log/messages# Time command date Timedatectl [[email protected] ~]$ timedatectl list-timezones | Head different time zones [[[email protected] ~]$ timedatectl set-timezone Asia/shanghai set shanghai time [[email protected] ~]$ Timedatectl Set-time "2012-12-21 10:00:00 "[[email protected] ~]$ date December 21, 2012 Friday 10:00:19 cst# Different server time synchronization [[email protected] yuq]  # cat/etc/ntp.conf

　　

"Linux logs" system logs and analysis

The Linux system has a very flexible and powerful logging function, which can save almost all the operation records and retrieve the information we need.

The default log daemon for most Linux distributions is Syslog, which is located in/etc/syslog or/etc/syslogd or/ETC/RSYSLOG.D, and the default configuration file is/etc/syslog.conf or rsyslog.conf, any program that wants to generate a log can send information to the syslog.

Linux system cores and many programs generate various error messages, warning messages, and other prompts that are useful for administrators to understand the state of the system, so they should be written to a log file.

The procedure to complete this process is syslog. Syslog can save logs to different files based on the category and priority of the log.

For example, for easy reference, you can separate the kernel information from other information and save it to a separate log file. In the default configuration, log files are usually saved in the "/var/log" directory.

Log type

The following are common log types, but not all Linux distributions contain these types:

type	Description
Auth	Logs generated when the user authenticates, such as the login command, the SU command.
Authpriv	Similar to auth, but can only be viewed by specific users.
Console	Messages for the system console.
Cron	The log that is generated when the system periodically executes scheduled tasks.
Daemon	Logs generated by some daemons.
Ftp	FTP Service.
Kern	System kernel messages.
Local0.local7	Used by custom programs.
Lpr	Related to printer activity.
Mail	Mail logs.
Mark	Generates a timestamp. The system outputs the current time to the log file at intervals, and each line is formatted like May 11:17:09 RS2-MARK-to infer the approximate time the system has failed.
News	The message generated by the Network News Transfer Protocol (NNTP).
Ntp	The message generated by the Network Time Protocol (NTP).
User	The user process.
Uucp	UUCP subsystem.

Log priority

Common log priorities See subscript:

Priority Level	Description
Emerg	In an emergency, the system is not available (such as a system crash) and is generally notified to all users.
Alert	Requires immediate repair, such as system database corruption.
Crit	Dangerous situations, such as hard drive errors, can hinder some of the program's functionality.
Err	Generic error message.
Warning	Warning.
Notice	Not an error, but may need to be handled.
Info	Generic messages are generally used to provide useful information.
Debug	The information that is generated by the debug program.
None	No priority, no log messages are logged.

/var/log/syslog or/var/log/messages stores all global system activity data, including boot information. Debian-based systems such as Ubuntu store them in/var/log/syslog, while RedHat-based systems such as RHEL or CentOS store them in/var/log/messages.
/var/log/auth.log or/var/log/secure stores logs from pluggable authentication modules (PAM) , including successful logins, failed login attempts, and authentication methods. Ubuntu and Debian store authentication information in/var/log/auth.log, while RedHat and CentOS store that information in/var/log/secure.

Detailed description of the log file:

/var/log/boot.log

This file records the events that occurred during the boot process, which is the information displayed by the Linux system post process, as shown in 1:

/var/log/syslog

The default Centos,fedora does not generate the log file, but you can configure/etc/syslog.conf to have the log file generated by the system.

It is different from the/etc/log/messages log file, it only records the warning message, often is the system problem information, so should be concerned about the file.

To have the log file generated by the system, add: *.warning/var/log/syslog The log file can record information such as error password, sendmail problem, su command execution failure when the user logged in/etc/syslog.conf.

This log file records the most recent successful logon event and the last unsuccessful logon event that was generated by login. Each time a user logs on, the file is a binary file and needs to be viewed using the Lastlog command, which displays the login name, port number, and last logon time based on the UID. If a user has never logged in, it is displayed as "**never logged in**". This command can only be performed with root privileges. Simply enter the Lastlog command and you will see a message similar to Figure 4:

[[email protected] etc]# lastlog

/var/log/wtmp

This log file permanently records each user's logon, logoff, and system startup, downtime events. Therefore, as the system uptime increases, the size of the file becomes larger and higher, depending on the number of times the system user logs on. The log file can be used to view the user's login record, the last command to access this file to obtain this information, and in reverse order from back to front to display the user's log-in record, can also be based on user, terminal TTY or time display corresponding records.

/var/run/utmp

The log file records information about each user who is currently logged on. As a result, the file changes as the user logs on and off the system, preserving only the user records that were online at that time and not keeping permanent records for the user. The system needs to query the current user state of the program, such as WHO, W, users, finger and so on need to access this file. The log file does not include all the exact information, because some burst errors terminate the user logon session, and the system does not update the UTMP record in a timely manner, so the log file record is not entirely trustworthy.

The 3 files mentioned above (/var/log/wtmp,/var/run/utmp,/var/log/lastlog) are the key files of the log subsystem, all of which record the user login. All records for these files contain timestamps. These files are stored in binary, so they cannot be viewed directly with commands such as less and cat, but they need to be viewed through these files using related commands. Where the data structures of utmp and wtmp files are the same, and Lastlog files use additional data structures, the concrete data structures for them can be queried using the man command.

Each time a user logs in, the login program looks at the UID of the user in the file lastlog. If present, the user's last logon, logoff time, and hostname are written to standard output, then the login program logs the new logon time in Lastlog, opens the Utmp file and inserts the user's utmp record. This record is always deleted when the user logs on and exits. utmp files are used by various commands, including WHO, W, users, and finger.

Next, the login program opens the file wtmp additional user's utmp record. When a user logs on and exits, the same utmp record with the update timestamp is appended to the file. The Wtmp file is used by the last program.

Rh124-log Linux Logs