Pehea e heluhelu ai i nā logs Linux a ma hea e loaʻa ai

Ke kū ʻoe i kekahi pilikia me ka hana o kāu kikowaena, ʻo ka mea mua āu e makemake ai e hana, ʻo ia ke nānā i kāu mau log Linux . Ma ka log ʻōnaehana, hiki iā ʻoe ke loaʻa i kekahi mau leka diagnostics kōkua mai nā ʻāpana like ʻole o ka ʻōnaehana hana e like me ka kernel a i ʻole nā ​​​​lawelawe like ʻole, no laila e ʻike paha ʻoe i ke kumu o ka hāʻule ʻana ma laila.

Hoʻokumu ʻia kēlā me kēia memo i loko o ka log i ka hopena o kekahi mau hanana i ka ʻōnaehana hana: mai ka mea hoʻohana, ʻae ʻia i ka pani ʻana i ka lawelawe a i ʻole ka hāʻule ʻana o ka noi. He ʻokoʻa ko kēia mau hanana ma muli o ko lākou koʻikoʻi. Aia nā ʻano hanana ma Linux:

1. emerg - ka hemahema, ka mea nui loa;
2. alert - ʻōlelo aʻo wikiwiki;
3. crit - hanana koʻikoʻi;
4. err - hewa maʻamau;
5. warn - ʻōlelo aʻo maʻamau;
6. notice - hoʻolaha;
7. info - memo ʻike;
8. debug - ka hoʻopau ʻana i ka ʻike;

I kēia manawa, ʻo nā lawelawe hōʻiliʻili log nui ma Linux ʻo rsyslog a me systemd-journald . Hoʻohana lākou i ka hapa nui o nā pūʻolo hoʻolaha hou a hana kūʻokoʻa.

rsyslog

Aia nā log o kēia lawelawe ma ka waihona " /var/log/ " ma ke ʻano o nā faila kikokikona maʻamau. Hoʻokomo ʻia nā leka log i nā faila like ʻole ma muli o ke ʻano o ka hanana. No ka laʻana, aia i loko o " /var/log/auth.log " ka ʻike e pili ana i ka ʻae ʻana o nā mea hoʻohana i loko o ka ʻōnaehana, a aia i loko o " /var/log/kern.log " nā leka kernel. Hiki ke ʻokoʻa nā inoa faila ma waena o nā pūʻolo hoʻolaha, no laila e nānā kākou i ka faila config e kiʻi i ka manaʻo o kahi " /etc/rsyslog.d/50-default.conf ".

Hōʻike kēia mau lula i ka faila i loaʻa kēlā me kēia ʻano o nā leka log. Hōʻike ka ʻaoʻao hema i ke ʻano o ka leka ma ke ʻano aʻe " [Source].[Priority] " a hōʻike ka ʻaoʻao ʻākau i ka inoa o ka faila log. I ke kākau ʻana i ke ʻano o ka leka hiki ke hoʻohui ʻia ke ʻano " * ". ʻO ia hoʻi ka waiwai hakahaka a i ʻole " ʻaʻohe " e wehe iā ia mai ka papa inoa. E nānā pono kākou i nā lula mua ʻelua.

“auth,authpriv.* /var/log/auth.log”
“*.*;auth,authpriv.none -/var/log/syslog”

ʻO ke kānāwai mua, ʻo ia hoʻi, e hoʻopaʻa ʻia nā leka āpau i loaʻa mai ke ʻano ʻae ʻia i loko o ka faila " /var/log/auth.log ". E hoʻopaʻa inoa ʻia nā hoʻāʻo ʻae ʻia a pau (nā mea i holomua a ʻaʻole paha) i loko o kēia faila. Hōʻike ka lua o ka lula e hoʻopaʻa ʻia nā leka āpau koe wale nō nā mea e pili ana i ka ʻae ʻia i loko o ka faila " /var/log/syslog ". ʻO kēia mau faila ʻelua ka mea kaulana loa. Hoʻākāka nā lula ma lalo nei i ke ala e mālama ai i nā log kernel " kern.* " a me nā log lawelawe leka uila " mail.* ".

Hiki ke wehe ʻia nā faila log me ke kōkua o kekahi mea hoʻoponopono kikokikona, e like me less , cat , tail . E wehe kākou i ka faila " /var/log/auth.log " .

less /var/log/auth.log

ʻO kēlā me kēia laina o ka faila he memo kaʻawale i loaʻa mai ka noi a lawelawe paha. ʻO nā memo a pau me ka nānā ʻole i ko lākou kumu he hoʻokahi ʻano a he 5 ʻāpana. E lawe kākou i ka memo i hōʻike ʻia ma ke kiʻi kiʻi ma ke ʻano he laʻana.

1. Kaha manawa memo - “Feb 12 06:18:33”
2. Ka inoa o ke kamepiula i hoʻouna i ka memo - "vds"
3. Ka inoa o ka noi a lawelawe paha i hoʻouna i ka memo - "sshd"
4. ID kaʻina hana - [653]
5. Memo kikokikona - "Apono ʻia ka ʻōlelo huna no mihail mai 188.19.42.165 awa 2849 ssh2"

He laʻana kēia o ka pilina kūleʻa iā SSH.

A penei ke ʻano o ka hoʻāʻo ʻana ʻaʻole i kūleʻa:

Hoʻopaʻa pū kēia faila i nā kauoha me nā ʻae holomua

E wehe kākou i ka faila /var/log/syslog

ʻO kahi memo i koʻikoʻi ʻia ma ke kiʻi kiʻi ka memo e pili ana i ka pani ʻana o ke kikowaena pūnaewele.

No ka ʻimi ʻana i ka ʻike ma o nā faila kikokikona lōʻihi e hoʻohana i ka pono grep . Hiki iā ʻoe ke loaʻa nā leka āpau i loaʻa mai ka lawelawe pptpd ma ka faila " /var/log/syslog ".

grep 'pptpd' /var/log/syslog

I ka wā o ka diagnostics hiki iā ʻoe ke hoʻohana i ka pono hana huelo e hiki ke hōʻike i kekahi mau laina hope o nā faila. ʻO ke kauoha " tail -f /var/log/syslog " e ʻae iā ʻoe e nānā i nā logs e hoʻopaʻa ana i ka manawa maoli.

He maʻalahi loa a ikaika hoʻi ka lawelawe rsyslog . Hiki ke hoʻohana ʻia no ka ʻohi ʻana i nā log i nā ʻōnaehana kūloko a me ka pae ʻoihana. Hiki iā ʻoe ke loaʻa nā palapala piha ma ka pūnaewele kūhelu https://www.rsyslog.com/

Ka hoʻololi ʻana i nā lāʻau ma Linux

Ke hana mau nei ka hoʻopaʻa ʻana i nā log, no laila ke ulu mau nei ka nui o nā faila. Hoʻopaʻa ka ʻōnaehana hoʻohuli i ka waihona ʻakomi o nā log kahiko a me ka hana ʻana o nā faila hou. Ma muli o nā lula, hiki ke hana i kēlā me kēia lā, pule, mahina a i ʻole ma ka palena nui. I ka hana ʻia ʻana o nā log hou, hiki ke holoi wale ʻia a hoʻouna ʻia paha nā mea kahiko ma o ka leka uila. Hana ʻia ka hoʻohuli ʻana o nā log e ka pono logrotate . Hiki iā ʻoe ke loaʻa ka hoʻonohonoho nui ma ka faila " /etc/logrotate.conf ". Hana ʻia nā ʻike faila ma ka waihona " /etc/logrotate.d/ ".

Hiki ke hoʻopaʻa inoa ʻia nā lula hou i loko o ka faila hoʻonohonoho nui. Eia nō naʻe, ʻoi aku ka maikaʻi o ka hana ʻana i kahi faila ʻokoʻa ma " /etc/logrotate.d/ ". Ma ka paʻamau, aia kekahi mau faila ma kēia papa kuhikuhi.

E nānā kākou i ka faila " /etc/logrotate.d/rsyslog " nona nā lula hoʻololi no nā log o ka lawelawe rsyslog.

ʻO ka mea mua, pono e loaʻa i ka lula ke ala i ka faila log a laila e hele i nā alakaʻi āpau i nā bracket curved.

• hoʻohuli 7 - ka helu o nā faila e mālama - 7
• kela la i keia - hana i kahi faila hou i kēlā me kēia lā
• pilikia - hoʻopaʻa a mālama i nā faila kahiko

Hiki iā ʻoe ke ʻike ma ke kiʻi paʻi aia ma ka waihona " /var/log/ " aia ka log nui " syslog " a me nā waihona 7, e kūlike ana me nā lula ma ka faila config.

Hiki iā ʻoe ke loaʻa kahi wehewehe kikoʻī hou aku o ka logrotate i loko o ka manual, e hoʻokō ana i ke kauoha " man logrotate ".

ʻOhi ʻana i nā lāʻau Linux - journald

ʻO ka lawelawe hōʻiliʻili log systemd-journald he ʻāpana ia o ka ʻōnaehana hoʻomaka systemd . Mālama ʻia nā faila log Linux ma " /var/log/journal/ " ma ke ʻano kūikawā a hiki ke wehe ʻia me ke kōkua o ka pono journalctl . Ua like loa ke ʻano o nā moʻolelo me ka rsyslog.

ʻO ke kauoha journalctl me ka ʻole o nā ʻano e hōʻike i nā moʻolelo āpau akā ʻaʻole kūpono ia no nā log nui aʻe. E nānā kākou i kekahi mau koho o kēia pono hana.

• journalctl -b - hōʻike i nā moʻolelo a pau mai ka hoʻomaka hope
• journalctl -S "2020-02-17 12:00" -U "2020-02-17 12:10" - hōʻike i ka moʻolelo i loko o kekahi manawa
• journalctl -u pptpd - hōʻike i nā moʻolelo o kekahi lawelawe
• journalctl -k - hōʻike i nā memo kernel
• journalctl -p err - hōʻike i nā memo o kahi mea nui, nā memo koʻikoʻi i kēia hihia (crit, alert, emerg)
• journalctl -f - hōʻike i nā memo i ka manawa maoli

No ka maʻalahi o ka maʻalahi hiki iā ʻoe ke hoʻohui i kēia mau koho. E hōʻike kākou i nā hewa āpau o ka lawelawe pptpd

journalctl -u pptpd -p err

Inā ʻoe e kuhikuhi i ke ala i ka faila hiki ke hoʻokō ʻia ma ke ʻano he ʻano, e hōʻike ka pono hana i nā leka āpau i hoʻouna ʻia e kēia faila. E hōʻike kākou i nā leka āpau i hoʻouna ʻia e ka faila " /usr/bin/sudo " mai 04:15 ma Pepeluali 18, 2020. ʻOiaʻiʻo, e hōʻike ia i nā kauoha āpau i hoʻokō ʻia me nā ʻae kiʻekiʻe.

journalctl -S "2020-02-18 04:15" /usr/bin/sudo

No ka ʻike ʻana i ka nui o nā faila log space disk e lawe ai e hoʻokō i kēia kauoha

journalctl --disk-usage

I mea e kaupalena ʻia ai ka faila log i 1Gb e hoʻokō i kēia kauoha

journalctl --vacuum-size=1G

E wehe ana i nā faila binary

I kēia manawa, e nānā kākou i kekahi mau faila kūikawā ma ka waihona " /var/log/ " kahi e mālama ʻia ai nā hoʻāʻo komo āpau. He binary kēia mau faila a hiki ke wehe ʻia me nā polokalamu kūikawā wale nō.

Aia i loko o /var/log/wtmp ka ʻike e pili ana i nā hoʻāʻo komo kūleʻa. E hoʻohana i ka pono hana hope loa e wehe iā ia.

/var/log/btmp - aia nā hoʻāʻo komo āpau i hāʻule. Hiki ke wehe ʻia me lastb me nā ʻae holomua. Hoʻākāka ka ʻano -n i ka helu o nā laina i hōʻike ʻia mai ka hopena o ka faila.

/var/log/lastlog - aia ka manawa o ka hana komo hope loa no kēlā me kēia moʻolelo moʻokāki. Hiki ke wehe ʻia me lastlog