Yadda ake karanta logs na Linux da inda za a same shi

Idan ka fuskanci wata matsala game da aikin sabar ka, abu na farko da kake son yi shine duba rajistan ayyukan Linux ɗinka . A cikin rajistan ayyukan tsarin, zaka iya samun wasu saƙonnin bincike masu taimako daga sassa daban-daban na tsarin aiki kamar kernel ko ayyuka daban-daban, don haka wataƙila zaka sami dalilin gazawar a can.

Kowane saƙo a cikin log ɗin ana haifar da shi a sakamakon wasu abubuwan da suka faru a cikin tsarin aiki: daga mai amfani, izini zuwa rufe sabis ko gazawar aikace-aikace. Waɗannan al'amuran suna da fifiko daban-daban dangane da yadda suke da mahimmanci. Akwai nau'ikan abubuwan da suka faru a cikin Linux:

1. emerg - gazawa, mafi girman fifiko;
2. alert - gargadi na gaggawa;
3. crit - lamari mai mahimmanci;
4. err - kuskure na yau da kullun;
5. warn - gargadi na yau da kullun;
6. notice - sanarwa;
7. info - sakon bayanai;
8. debug - bayanin kuskure;

A yanzu, manyan ayyukan tattara guntun itace a Linux sune rsyslog da systemd-journald . Suna tafiya tare da yawancin fakitin rarrabawa na zamani kuma suna aiki daban-daban.

rsyslog

Rijistar wannan sabis ɗin tana cikin babban fayil ɗin " /var/log/ " a cikin nau'in fayilolin rubutu na yau da kullun. Ana sanya saƙonnin rajista a cikin fayiloli daban-daban dangane da nau'in abin da ya faru. Misali, " /var/log/auth.log " ya ƙunshi bayanai game da izinin masu amfani a cikin tsarin, kuma " /var/log/kern.log " ya ƙunshi saƙonnin kernel. Sunayen fayiloli na iya bambanta a cikin fakitin rarrabawa, don haka bari mu duba fayil ɗin daidaitawa don samun ra'ayin menene " /etc/rsyslog.d/50-default.conf ".

Waɗannan ƙa'idodi suna nuna wane fayil ne ke ɗauke da kowane nau'in saƙonnin rajista. Bangaren hagu yana nuna nau'in saƙon a cikin nau'in mai zuwa " [Tushe].[Fifiko] " kuma ɓangaren dama yana nuna sunan fayil ɗin rajista. Yayin rubuta nau'in saƙon " * " ana iya ƙara shi. Yana nufin ƙimar da babu komai ko " babu " wanda ke cire shi daga jerin. Bari mu yi la'akari da ƙa'idodi biyu na farko.

“auth,authpriv.* /var/log/auth.log”
“*.*;auth,authpriv.none -/var/log/syslog”

Dokar farko tana nufin cewa duk saƙonnin da aka karɓa daga tsarin izini za a rubuta su cikin fayil ɗin " /var/log/auth.log ". Duk yunƙurin izini (duka sun yi nasara ko ba su yi nasara ba) za a yi rijista a cikin wannan fayil ɗin. Dokar ta biyu ta nuna cewa duk saƙonni banda waɗanda ke da alaƙa da izini za a rubuta su cikin fayil ɗin " /var/log/syslog ". Waɗannan fayiloli guda biyu galibi sune mafi shahara. Dokokin masu zuwa suna bayyana hanyar adana bayanan kernel " kern.* " da bayanan sabis na wasiƙa " mail.* "

Ana iya buɗe fayilolin log tare da taimakon kowane editan rubutu, kamar less , cat , tail . Bari mu buɗe fayil ɗin " /var/log/auth.log "

less /var/log/auth.log

Kowane layi na fayil ɗin saƙo ne daban da aka karɓa daga aikace-aikacen ko sabis. Duk saƙonni ba tare da la'akari da tushen su suna da tsari ɗaya kuma sun ƙunshi sassa 5 ba. Bari mu ɗauki fitaccen saƙon da ke cikin hoton allo a matsayin misali.

1. Tambarin saƙo - "Fabrairu 12 06:18:33"
2. Sunan kwamfutar da ta aiko da sakon - "vds"
3. Sunan aikace-aikacen ko sabis ɗin da ya aika saƙon - "sshd"
4. ID tsari - [653]
5. Rubutun saƙo - "Masu kalmar sirri da aka karɓa don mihail daga 188.19.42.165 tashar jiragen ruwa 2849 ssh2"

Wannan misali ne na haɗin kai mai nasara zuwa SSH.

Ga kuma yadda yunƙurin shiga da bai yi nasara ba ya yi kama:

Wannan fayil kuma yana yin rikodin umarni tare da izini na ci gaba

Bari mu buɗe fayil ɗin /var/log/syslog

Saƙon da aka haskaka akan hoton hoton shine saƙon game da rufe hanyar sadarwa ta hanyar sadarwa.

Don neman bayanai ta hanyar manyan fayilolin rubutu, yi amfani da grep utility. Kuna iya samun duk saƙonnin da aka karɓa daga sabis na pptpd a cikin fayil ɗin " /var/log/syslog ".

grep 'pptpd' /var/log/syslog

A lokacin binciken, za ka iya amfani da manhajar wutsiya wadda za ta iya nuna layukan ƙarshe da dama na fayiloli. Umarnin “ wutsiya -f /var/log/syslog ” zai baka damar kallon rikodin da ke rikodi a ainihin lokaci.

Sabis ɗin rsyslog yana da sassauƙa da ƙarfi sosai. Ana iya amfani da shi don tattara katako a tsarin gida da kuma a matakin kasuwanci. Kuna iya samun cikakkun takardu a gidan yanar gizon hukuma https://www.rsyslog.com/

Logs juyawa a cikin Linux

Rikodin rajista yana faruwa akai-akai, don haka girman fayilolin yana ƙaruwa koyaushe. Tsarin juyawa yana tabbatar da adana tsoffin rajista ta atomatik da ƙirƙirar sabbin fayiloli. Dangane da ƙa'idodi, yana iya faruwa kowace rana, mako-mako, kowane wata ko ta iyaka girman. Yayin da ake ƙirƙirar sabbin rajista, ana iya share tsoffin rajista ko aika su ta imel kawai. Ana yin jujjuyawar rajista ta amfani da kayan aikin logrotate . Kuna iya samun babban tsari a cikin fayil ɗin " /etc/logrotate.conf ". Ana kuma sarrafa abubuwan da ke cikin fayiloli a cikin babban fayil ɗin " /etc/logrotate.d/ " .

Ana iya shigar da sabbin ƙa'idodi cikin babban fayil ɗin tsari. Duk da haka, ya fi kyau a ƙirƙiri fayil daban a cikin " /etc/logrotate.d/ ". Ta hanyar tsoho, akwai fayiloli kaɗan a cikin wannan kundin adireshi

Bari mu duba fayil ɗin " /etc/logrotate.d/rsyslog " wanda ya ƙunshi ƙa'idodin juyawa don rajistar ayyukan rsyslog.

Da farko, yakamata doka ta ƙunshi hanyar zuwa fayil ɗin log ɗin sannan tafi duk jagororin cikin maƙallan maƙallan.

• juya 7 - adadin fayiloli don kiyayewa - 7
• kullum - ƙirƙirar sabon fayil kowace rana
• damfara - damfara da adana tsoffin fayiloli

Za ka iya gani a kan hoton allo cewa a cikin babban fayil ɗin " /var/log/ " akwai babban log " syslog " da kuma rumbun adana bayanai guda 7, wanda ya yi daidai da ƙa'idodin da ke cikin fayil ɗin saitin.

Kuna iya samun cikakken bayani game da logrotate a cikin littafin jagora, aiwatar da umarnin " man logrotate "

Tattara rajistan ayyukan Linux - jarida

Sabis na girbin rajista na systemd-journald wani ɓangare ne na tsarin farawa na systemd . Ana adana fayilolin rajista na Linux a cikin " /var/log/journal/ " a cikin tsari na musamman kuma ana iya buɗe su tare da taimakon utility na journalctl . Tsarin rikodi iri ɗaya ne da na rsyslog.

Umarnin journalctl ba tare da sifofi ba yana nuna duk bayanan amma bai dace da manyan rajista ba. Bari mu duba wasu zaɓuɓɓuka na wannan kayan aikin.

• journalctl -b - nuna duk bayanan tun farkon farawa
• journalctl -S "2020-02-17 12:00" -U "2020-02-17 12:10" - nuna rikodin a cikin wani takamaiman lokaci
• journalctl -u pptpd - nuna bayanan wani sabis
• journalctl -k - nuna saƙonnin kwaya
• journalctl -p err - nuna saƙonnin takamaiman fifiko, saƙon fifiko mafi girma a cikin wannan yanayin (crit, faɗakarwa, fitowar)
• journalctl -f - nuna saƙonni a cikin ainihin-lokaci

Domin samun sassauci mafi kyau, za ku iya haɗa waɗannan zaɓuɓɓukan. Bari mu nuna duk kurakuran sabis ɗin pptpd.

journalctl -u pptpd -p err

Idan ka ƙayyade hanyar zuwa fayil ɗin da za a iya aiwatarwa a matsayin sifa, mai amfani zai nuna duk saƙonnin da wannan fayil ɗin ya aika. Bari mu nuna duk saƙonnin da fayil ɗin " /usr/bin/sudo " ya aika tun daga ƙarfe 04:15 a ranar 18 ga Fabrairu, 2020. A zahiri, zai nuna duk umarni da aka aiwatar tare da izini mafi girma.

journalctl -S "2020-02-18 04:15" /usr/bin/sudo

Don nemo nawa fayilolin log ɗin sararin faifai ke ɗauka don aiwatar da umarni mai zuwa

journalctl --disk-usage

Domin iyakance fayil ɗin log ɗin zuwa 1Gb aiwatar da umarni mai zuwa

journalctl --vacuum-size=1G

Buɗe fayilolin binary

Yanzu bari mu kalli wasu fayiloli na musamman a cikin babban fayil ɗin " /var/log/ " inda ake adana duk ƙoƙarin shiga. Waɗannan fayilolin binary ne kuma ana iya buɗe su da shirye-shirye na musamman kawai.

/var/log/wtmp ya ƙunshi bayanai kan nasarar yunƙurin shiga. Yi amfani da kayan aikin ƙarshe don buɗe shi.

/var/log/btmp - ya ƙunshi duk yunƙurin shiga da ya gaza. Ana iya buɗe shi da lastb tare da izini na ci gaba. Siffar -n tana bayyana adadin layukan da aka nuna daga ƙarshen fayil ɗin.

/var/log/lastlog - ya ƙunshi lokacin aikin shiga na ƙarshe ga kowane rikodin asusu. Ana iya buɗe shi da lastlog