Ina pāngia koe e ngā raruraru me te mahi a tō tūmau, ko te mea tuatahi me mahi e koe ko te tirotiro i ō rangitaki Linux . I roto i te rangitaki pūnaha, ka kitea e koe ētahi karere tātaritanga āwhina mai i ngā wāhanga rerekē o te pūnaha whakahaere pērā i te kernel, i ngā ratonga rerekē rānei, nō reira ka kitea pea e koe te take o te rahunga i reira.
Ko nga karere katoa i roto i te raarangi ka puta mai i etahi huihuinga i roto i te punaha whakahaere: mai i te kaiwhakamahi, whakamanatanga ki te katinga ratonga, ki te kore tono ranei. He rereke nga kaupapa matua o enei huihuinga i runga i te ahua nui o aua kaupapa. E whai ake nei nga momo huihuinga i Linux:
emerg- te kore, te kaupapa matua;alert- whakatupato wawe;crit- hui nui;err- hapa noa;warn- whakatupato noa;notice- whakamōhiotanga;info- karere korero;debug- patuiro korero;
I tēnei wā, ko ngā ratonga matua e kohi rangitaki ana i roto i te Linux ko te rsyslog me te systemd-journald . Ka whakamahia ngātahi ēnei ratonga me te nuinga o ngā mōkihi tohatoha hou, ā, ka mahi takitahi.
rsyslog
Kei roto i te kōpaki " /var/log/ " ngā rangitaki o tēnei ratonga hei kōnae tuhinga noa. Ka whakatakotoria ngā karere rangitaki ki roto i ngā kōnae rerekē i runga i te momo huihuinga. Hei tauira, kei roto i te " /var/log/auth.log " ngā mōhiohio mō te whakamanatanga a ngā kaiwhakamahi i roto i te pūnaha, ā, kei roto i te " /var/log/kern.log " ngā karere kernel. Ka rerekē pea ngā ingoa kōnae puta noa i ngā mōkihi tohatoha, nō reira me titiro tātou ki te kōnae whirihora kia mārama ai kei hea " /etc/rsyslog.d/50-default.conf ".
Mā ēnei ture ka whakaatuhia ko tēhea kōnae kei roto ia momo karere rangitaki. Ka whakaatuhia e te taha maui te momo karere i te puka e whai ake nei " [Pūtake].[Matuatanga] " ā, ka whakaatuhia e te taha matau te ingoa o te kōnae rangitaki. I a koe e tuhi ana i te momo karere, ka taea te tāpiri i te tohu " * ". Ko tōna tikanga he uara kau, he " kore rānei " rānei e tango ana i te rārangi. Me titiro tata atu tātou ki ngā ture tuatahi e rua.
“auth,authpriv.* /var/log/auth.log”
“*.*;auth,authpriv.none -/var/log/syslog”Ko te tikanga o te ture tuatahi, ko ngā karere katoa i whiwhi mai i te tikanga whakamanatanga ka tuhia ki roto i te kōnae " /var/log/auth.log ". Ko ngā nganatanga whakamanatanga katoa (e angitu ana, e kore rānei) ka rēhitatia ki roto i tēnei kōnae. Ko te ture tuarua e tohu ana ko ngā karere katoa engari ko ērā e pā ana ki te whakamanatanga ka tuhia ki roto i te kōnae " /var/log/syslog ". Ko ēnei kōnae e rua te nuinga o te wā e tino rongonui ana. Ko ngā ture e whai ake nei e tautuhi ana i te ara ki te penapena i ngā rangitaki kernel " kern.* " me ngā rangitaki ratonga mēra " mail.* "
Ka taea te whakatuwhera i ngā kōnae takiuru mā te whakamahi i tētahi ētita tuhinga, pērā i te less , cat , tail . Me whakatuwhera te kōnae " /var/log/auth.log ".
less /var/log/auth.log
Ko ia rarangi o te konae he karere motuhake mai i te tono, ratonga ranei. Ko nga karere katoa ahakoa he aha te puna he kotahi te whakatakotoranga, e 5 nga wahanga. Kia tango a te karere miramira i roto i te Whakaahuamata hei tauira.
- Waitohu wa karere - “Feb 12 06:18:33”
- Ingoa o te rorohiko i tuku karere - “vds”
- Ingoa o te tono, ratonga ranei nana i tuku te karere - "sshd"
- Tukatuka ID - [653]
- Kuputuhi karere - “Kua whakaaetia te kupuhipa mo mihail mai i te tauranga 188.19.42.165 2849 ssh2”
He tauira tenei mo te hononga angitu ki te SSH.
Anei te ahua o te nganatanga takiuru kaore i angitu:
Ka tuhi ano hoki tenei konae i nga tono whai mana whai mana
Me whakatuwhera te kōnae /var/log/syslog
He karere kua tohua i runga i te Whakaahuamata ko te karere mo te katinga atanga whatunga.
Mō te rapu mōhiohio mā roto i ngā kōnae tuhinga roa, whakamahia te taputapu grep . Ka kitea e koe ngā karere katoa i whiwhi mai i te ratonga pptpd i roto i te kōnae " /var/log/syslog ".
grep 'pptpd' /var/log/syslog
I te wā o te tātaritanga, ka taea e koe te whakamahi i te taputapu hiku e whakaatu ana i ētahi rārangi whakamutunga o ngā kōnae. Mā te whakahau " hiku -f /var/log/syslog " ka taea e koe te mātaki i ngā rangitaki e tuhia ana i te wā tūturu.
He tino ngāwari, he kaha hoki te ratonga rsyslog . Ka taea te whakamahi mō te hauhake i ngā rangitaki i roto i ngā pūnaha ā-rohe me te taumata hinonga hoki. Ka kitea e koe ngā tuhinga katoa i te paetukutuku mana https://www.rsyslog.com/
Te hurihanga rangitaki i Linux
Kei te haere tonu te tuhi takiuru, nō reira ka piki haere tonu te rahi o ngā kōnae. Mā te tikanga hurihuri ka taea te pupuri aunoa i ngā rangitaki tawhito me te waihanga i ngā kōnae hou. I runga i ngā ture, ka taea te mahi i ia rā, i ia wiki, i ia marama, i ia tau rānei, i runga rānei i te rohe rahi. I te hanganga o ngā rangitaki hou, ka taea te muku noa i ngā rangitaki tawhito, te tuku īmēra rānei. Ka mahia te hurihuri rangitaki e te taputapu logrotate . Ka kitea e koe te whirihoranga matua i roto i te kōnae " /etc/logrotate.conf ". Ka tukatukahia hoki ngā ihirangi kōnae i roto i te kōpaki " /etc/logrotate.d/ ".
Ka taea te takiuru i ngā ture hou ki roto i te kōnae whirihora matua. Heoi, he pai ake te waihanga i tētahi kōnae motuhake ki " /etc/logrotate.d/ ". Hei taunoa, he torutoru ngā kōnae kei roto i tēnei kōpaki.
Me titiro tātou ki te kōnae " /etc/logrotate.d/rsyslog " kei roto ngā ture hurihanga mō ngā rangitaki o te ratonga rsyslog.
Tuatahi, me uru ki te ture te ara ki te konae rangitaki katahi ka haere nga aratohu katoa ki roto i nga taiapa kopikopiko.
- takahuri 7 - te maha o nga konae hei pupuri - 7
- rā - hanga he konae hou ia ra
- pupuhi - kōpeke me te pūranga kōnae tawhito
Ka kitea i te pikitia mata kei roto i te kōpaki " /var/log/ " te rangitaki matua " syslog " me ngā pūranga e 7, e hangai ana ki ngā ture o te kōnae whirihora.
Kei roto i te pukapuka ā-ringa te whakamārama taipitopito mō te logrotate, mā te whakamahi i te whakahau " man logrotate ".
Kohikohi rangitaki Linux - journald
Ko te ratonga hauhake rangitaki systemd-journald he wāhanga o te pūnaha tīmatanga systemd . Kei roto i te whakatakotoranga motuhake ngā kōnae rangitaki Linux, ā, ka taea te whakatuwhera mā te whakamahi i te taputapu journalctl . He rite tonu te whakatakotoranga o ngā rekoata ki te rsyslog.
Ko te whakahau "journalctl" kāore he huanga e whakaatu ana i ngā tuhinga katoa engari kāore e pai mō ngā rangitaki nui ake. Me titiro tātou ki ētahi kōwhiringa o tēnei taputapu.
journalctl -b- whakaatu nga rekoata katoa mai i te timatanga whakamutungajournalctl -S "2020-02-17 12:00" -U "2020-02-17 12:10"- whakaatu rekoata i roto i tetahi waajournalctl -u pptpd- whakaatu rekoata o tetahi ratongajournalctl -k- whakaatu karere kerneljournalctl -p err- whakaatu i nga karere o tetahi kaupapa matua, nga karere matua teitei ake i tenei keehi(crit, alert, emerg)journalctl -f- whakaatu karere i roto i te wa-tūturu
Mō te ngāwari ake, ka taea e koe te whakakotahi i ēnei kōwhiringa. Me whakaatu ngā hapa katoa o te ratonga pptpd.
journalctl -u pptpd -p err
Ki te tohua e koe te ara ki te kōnae whakahaere hei huanga, ka whakaatuhia e te taputapu ngā karere katoa i tukuna e tēnei kōnae. Me whakaatu ngā karere katoa i tukuna e te kōnae " /usr/bin/sudo " mai i te 04:15 i te 18 o Pēpuere, 2020. Inaa, ka whakaatuhia ngā whakahau katoa i whakahaerehia me ngā whakaaetanga teitei ake.
journalctl -S "2020-02-18 04:15" /usr/bin/sudo
Kia mohio ai koe ki te nui o nga konae mokowā mokowā mokowā ki te mahi i te whakahau e whai ake nei
journalctl --disk-usageHei whakawhāiti i te kōnae rangitaki ki te 1Gb mahia te whakahau e whai ake nei
journalctl --vacuum-size=1GTe whakatuwhera i nga konae rua
Nā, me titiro tātou ki ētahi kōnae motuhake kei roto i te kōpaki " /var/log/ " kei reira ngā nganatanga takiuru katoa e rongoa ana. He kōnae rua ēnei, ā, ka taea anake te whakatuwhera mā ngā papatono motuhake.
Kei roto i te /var/log/wtmp ngā mōhiohio mō ngā nganatanga takiuru angitu. Whakamahia te taputapu whakamutunga hei whakatuwhera.
/var/log/btmp - kei roto ngā nganatanga takiuru katoa i rahua. Ka taea te whakatuwhera mā te lastb me ngā whakaaetanga matatau. Ko te huanga -n te tohu i te maha o ngā rārangi e whakaaturia ana mai i te pito o te kōnae.
/var/log/lastlog - kei roto ko te wā o te mahi takiuru whakamutunga mō ia pūkete. Ka taea te whakatuwhera me te lastlog
