Maitiro ekuverenga matanda eLinux uye kuti ungaiwanepi

Kana ukasangana nematambudziko nekushanda kweseva yako, chinhu chekutanga chaunoda kuita ndechekutarisa maLinux logs ako . Musystem log, unogona kuwana mamwe mameseji anobatsira ekuongorora kubva kuzvikamu zvakasiyana zveoperating system senge kernel kana masevhisi akasiyana, saka unogona kuwana chikonzero chekukundikana ipapo.

Yese meseji murogi inogadzirwa mumhedzisiro yezvimwe zviitiko mushandisi sisitimu: kubva kumushandisi, mvumo kune sevhisi kuvhara-pasi kana kutadza kushanda. Zviitiko izvi zvine zvakakosheswa zvakasiyana zvichienderana nekukosha kwazvo. Kune anotevera marudzi ezviitiko muLinux:

1. emerg - kukundikana, kunyanya kukosha;
2. alert - kukurumidza nyevero;
3. crit - chiitiko chakakosha;
4. err - kukanganisa kwakajairika;
5. warn - yambiro yakajairika;
6. notice - chiziviso;
7. info - meseji yeruzivo;
8. debug - ruzivo rwekugadzirisa;

Parizvino, masevhisi makuru ekukohwa matanda muLinux ndeekuti rsyslog na systemd-journald . Anoshanda nemapakeji mazhinji emazuva ano ekuparadzira matanda uye anoshanda ega.

rsyslog

Marogi ebasa iri ari mu " /var/log/ " folda iri muchimiro chemafaira emavara akajairwa. Mameseji erogi anoiswa mumafaira akasiyana zvichienderana nerudzi rwechiitiko. Semuenzaniso, " /var/log/auth.log " ine ruzivo nezvekubvumidzwa kwevashandisi musystem, uye " /var/log/kern.log " ine mameseji ekernel. Mazita emafaira anogona kusiyana mumapakeji ekugovera, saka ngatitarisei faira rekugadzirisa kuti tinzwisise kuti " /etc/rsyslog.d/50-default.conf " iri kupi.

Mitemo iyi inoratidza kuti faira ripi rine mhando yega yega yemashoko elog. Chikamu chekuruboshwe chinoratidza rudzi rwemashoko muchimiro chinotevera " [Source].[Priority] " uye chikamu chekurudyi chinoratidza zita refaira relog. Paunenge uchinyora, mhando yemeseji " * " inogona kuwedzerwa. Zvinoreva kukosha kusina chinhu kana " hapana " zvinoibvisa pane rondedzero. Ngatinyatsoongorora mitemo miviri yekutanga.

“auth,authpriv.* /var/log/auth.log”
“*.*;auth,authpriv.none -/var/log/syslog”

Mutemo wekutanga unoreva kuti mameseji ese anogamuchirwa kubva kunzira yekubvumidza achanyorwa mufaira re " /var/log/auth.log ". Kuedza kwese kwekubvumidza (kwakabudirira uye kwete) kuchanyoreswa mufaira iri. Mutemo wechipiri unoratidza kuti mameseji ese kunze kweaya akabatana nekubvumidza achanyorwa mufaira re " /var/log/syslog ". Mafaira maviri aya anowanzo kufarirwa zvakanyanya. Mitemo inotevera inotsanangura nzira yekuchengetedza malogi ekernel " kern.* " uye malogi ebasa retsamba " mail.* "

Mafaira eLog anogona kuvhurwa nerubatsiro rwechero text editor, senge less , cat , tail . Ngativhure faira rekuti “ /var/log/auth.log ”

less /var/log/auth.log

Mutsara wega wega wefaira iri meseji yakaparadzana yakagamuchirwa kubva kune application kana sevhisi. Mameseji ese zvisinei nekwaanobva ane fomati imwe chete uye ane zvikamu zvishanu. Ngatitorei meseji yakasimbiswa muscreenshot semuenzaniso.

1. Chitambi chemeseji - "Feb 12 06:18:33"
2. Zita rekombuta yakatumira meseji - "vds"
3. Zita rekushandisa kana sevhisi yakatumira meseji - "sshd"
4. Maitiro ID - [653]
5. Runyoro rwemeseji - "Pasiwedhi inogamuchirwa ye mihail kubva 188.19.42.165 port 2849 ssh2"

Uyu waive muenzaniso wekubatana kwakabudirira kune SSH.

Uye heino maitiro asina kubudirira kuedza kupinda mukati:

Iyi faira zvakare inorekodha mirairo ine mvumo yepamusoro

Ngativhure faira re /var/log/syslog

Meseji yakasimbiswa pascreenshot ndiyo meseji nezve network network kuvharika.

Kuti utsvage ruzivo kuburikidza nemafaira marefu emavara shandisa grep utility. Unogona kuwana meseji dzese dzakagamuchirwa kubva kuPPTPD service mufaira re " /var/log/syslog ".

grep 'pptpd' /var/log/syslog

Munguva yekuongorora, unogona kushandisa tail utility iyo inogona kuratidza mitsara yekupedzisira yemafaira. Murairo wekuti “ tail -f /var/log/syslog ” uchakubvumidza kuti utarise marogi achirekodha panguva chaiyo.

Sevhisi ye rsyslog inochinjika uye ine simba. Inogona kushandiswa kuunganidza matanda mumasisitimu emunharaunda pamwe nepadanho rebhizinesi. Unogona kuwana magwaro akazara pawebhusaiti yepamutemo https://www.rsyslog.com/

Logs kutenderera muLinux

Kurekodha magwaro kuri kuitika nguva dzose, saka saizi yemafaira inogara ichikura. Maitiro ekutenderera anovimbisa kuchengetedza otomatiki magwaro ekare uye kugadzirwa kwemafaira matsva. Zvichienderana nemitemo, zvinogona kuitika zuva nezuva, vhiki nevhiki, mwedzi nemwedzi kana nehukuru hwakatarwa. Sezvo magwaro matsva achigadzirwa, ekare anogona kungodzimwa kana kutumirwa neemail. Kutenderera magwaro kunoitwa ne logrotate utility. Unogona kuwana main configuration mu " /etc/logrotate.conf " file. Zviri mumafaira zvinogadziriswawo mu " /etc/logrotate.d/ " folder

Mitemo mitsva inogona kuiswa mufaira guru rekugadzirisa. Zvisinei, zvakanaka kugadzira faira rakasiyana mu " /etc/logrotate.d/ ". Nekuda kweizvozvo, pane mafaira mashoma mudhairekitori iri

Ngatitarisei faira rekuti " /etc/logrotate.d/rsyslog " rine mitemo yekutenderera ye log dze rsyslog service.

Chekutanga, mutemo unofanirwa kuve negwara rinoenda kune regi faira uye wobva waenda ese nhungamiro mumabhuraketi akakomberedzwa.

• tenderera 7 - nhamba yemafaira ekuchengeta - 7
• mazuva ose - gadzira faira nyowani mazuva ese
• compress - compress uye chengetedza mafaera ekare

Unogona kuona pamufananidzo wepikicha kuti mu " /var/log/ " folda mune " syslog " huru yelog uye 7 archives, zvinoenderana nemitemo iri mufaira reconfig.

Unogona kuwana tsananguro yakadzama ye logrotate mubhuku rekushandisa, uchitevera murairo we " man logrotate ".

Kuunganidza Linux matanda - yakanyorwa

Basa rekukohwa matanda systemd-journald chikamu che system yekutanga systemd . Mafaira eLinux log anochengetwa mu " /var/log/journal/ " mune imwe fomati uye anogona kuvhurwa nerubatsiro rwe journalctl utility. Mafomati ezvinyorwa akafanana chaizvo neari mu rsyslog.

Command journalctl isina hunhu inoratidza zvinyorwa zvese asi haina kukodzera magwaro makuru. Ngatitarisei dzimwe sarudzo dzekushandisa uku.

• journalctl -b - ratidza marekodhi ese kubva pakutanga kwekupedzisira
• journalctl -S "2020-02-17 12:00" -U "2020-02-17 12:10" - ratidza rekodhi mukati meimwe nguva yenguva
• journalctl -u pptpd - ratidza zvinyorwa zveimwe sevhisi
• journalctl -k - ratidza kernel mameseji
• journalctl -p err - ratidza mameseji ezvimwe zvakakosha, mameseji epamusoro mune ino kesi (crit, chenjedzo, kubuda)
• journalctl -f - ratidza mameseji munguva chaiyo

Kuti mugone kuchinja zviri nani munogona kusanganisa sarudzo idzi. Ngatiratidzei zvikanganiso zvese zvebasa repptpd

journalctl -u pptpd -p err

Kana ukataura nzira yekuenda kufaira rinoitwa sehunhu, chishandiso chicharatidza mameseji ese anotumirwa nefaira iri. Ngatiratidze mameseji ese anotumirwa nefaira " /usr/bin/sudo " kubvira 04:15 musi wa18 Kukadzi, 2020. Kutaura zvazviri, icharatidza mirairo yese yakaitwa nemvumo yepamusoro.

journalctl -S "2020-02-18 04:15" /usr/bin/sudo

Kuti uwane kuti ingani disk space log mafaera anotora kutora unotevera kuraira

journalctl --disk-usage

Kuti udzikise faira regi ku1Gb ita murairo unotevera

journalctl --vacuum-size=1G

Kuvhura mabhinari mafaira

Iye zvino ngatitarisei mamwe mafaira akakosha ari mufolda ye " /var/log/ " uko kuyedza kwese kupinda kunochengetwa. Mafaira aya ndeebinary uye anogona kuvhurwa nemapurogiramu akakosha chete.

/var/log/wtmp ine ruzivo rwekuti vanhu vakaedza kupinda mu "login" zvakabudirira. Shandisa "last utility" kuti uivhure.

/var/log/btmp - ine zvese zvakakundikana kuedza kupinda. Inogona kuvhurwa ne lastb ine mvumo yepamusoro. Attribute -n inotsanangura huwandu hwemitsara inoratidzwa kubva kumagumo kwefaira.

/var/log/lastlog - ine nguva yekupinda kwekupedzisira kweakaundi yega yega. Inogona kuvhurwa ne lastlog