基于Linux下的系统日志

实验一开始我们需要重启两台虚拟机,然后配置ip地址,然后在真机打开两个shell分别连接两个IP地址,将两台虚拟机名字分别改为node1和node2方便操作时进行辨认,本节课我们来学习日志。

更改名字命令如下:

 hostnamectl set-hostname node1.example.com

基于Linux下的系统日志_第1张图片

 hostnamectl set-hostname node2.example.com

基于Linux下的系统日志_第2张图片

1.日志采集规则:

用node1操作:日志存在于内存,rsyslog命令的意义在于将内存里面的东西收集放到硬盘里面。

[root@node1 ~]# > /var/log/messages           清空日志

[root@node1 ~]# cat /var/log/messages    

[root@node1 ~]# systemctl restart sshd.service     重启动

[root@node1 ~]# cat /var/log/messages              查看文件

Apr 13 21:59:19 localhost systemd: Stopping OpenSSH server daemon...

Apr 13 21:59:19 localhost systemd: Starting OpenSSH server daemon...

Apr 13 21:59:19 localhost systemd: Started OpenSSH server daemon.

基于Linux下的系统日志_第3张图片

[root@node1 ~]# systemctl stop rsyslog.service    停止收集日志的服务

[root@node1 ~]# > /var/log/messages

[root@node1 ~]# systemctl restart sshd.service

[root@node1 ~]# cat /var/log/messages             查看时候没有日志

[root@node1 ~]# systemctl start rsyslog.service   开始收集日志的服务

[root@node1 ~]# cat /var/log/messages

Apr 13 22:00:27 node1 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="30481" x-info="http://www.rsyslog.com"] start

Apr 13 22:00:27 node1 rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [try http://www.rsyslog.com/e/2307 ]

Apr 13 21:59:49 node1 systemd: Stopping System Logging Service...

Apr 13 21:59:49 node1 systemd: Stopped System Logging Service.

基于Linux下的系统日志_第4张图片   

[root@node1 ~]# vim /etc/rsyslog.conf   编辑配置文件,把我们想保存的日志放在我们希望的目录中   *.* /var/log/westos

[root@node1 ~]# ls /var/log/westos

ls: cannot access /var/log/westos: No such file or directory

[root@node1 ~]# systemctl restart sshd.service

[root@node1 ~]# cat /var/log/westos

cat: /var/log/westos: No such file or directory

[root@node1 ~]# systemctl restart rsyslog.service 重启查看

[root@node1 ~]# cat /var/log/westos

Apr 13 22:03:25 node1 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="30596" x-info="http://www.rsyslog.com"] start

Apr 13 22:03:25 node1 rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [try http://www.rsyslog.com/e/2307 ]

Apr 13 22:03:25 node1 systemd: Stopping System Logging Service...

Apr 13 22:03:25 node1 systemd: Starting System Logging Service...

Apr 13 22:03:25 node1 systemd: Started System Logging Service.

基于Linux下的系统日志_第5张图片

在node2操作:

[root@node2 ~]# vim 第七天笔记

[root@node2 ~]# ssh [email protected]   连接第一台主机

[email protected]'s password:

Last login: Fri Apr 13 22:11:07 2018 from 172.25.254.221

[root@node1 ~]# cat /var/log/westos       查看配置文件

Apr 13 22:32:39 node1 sshd[31011]: pam_unix(sshd:session): session opened for user root by (uid=0)

刚才的连接操作已经被记录在配置文件当中。

基于Linux下的系统日志_第6张图片

日志规则:

*.*                      文件名称

日志类型.日志级别         日志存放文件


日志类型

auth              用户登录日志(产生日志)

authpriv          服务认证日志

kern              内核日志

cron              定时任务日志

lpr               打印机日志

mail              邮件日志

news              新闻日志

user              用户相关程序日志

local 1-7         用户自定义日志

 

日志级别

debug           系统调试信息

info            常规信息

warning         警告信息

error           报错信息(级别低,阻止了某个功能不能正常运行)

crit            报错(级别高,阻止了整个软件或者系统不能正常工作)

alert           需要立即修改的信息

emerg           内核崩溃

none            不采集任何日志信息

 

vim /etc/rsyslog.conf

auth.debug             /var/log/westos

auth.*

*.*                     /var/log/log.all

 

系统常用日志:

/var/log/messages       所有日志级别的常规信息,不包含邮件,服务认证,定时任务

/var/log/maillog        邮件日志

/var/log/secure         服务认证日志

/var/log/cron           定时任务认证

 

2.日志的远程同步(运维人员方便查看所有人的日志方便管理)

在日志发送方:node1

vim /etc/rsyslog.conf

*.*          @172.25.254.221(一个@代表UDP,两个@代表TCP)

systemctl restart rsyslog.services

具体操作:

[root@node1 ~]# vim /etc/rsyslog.conf          输入接受方主机地址

[root@node1 ~]# systemctl restart rsyslog      重启编辑配置文件

[root@node1 ~]# systemctl restart sshd.service 输入命令查看效果

[root@node1 ~]# systemctl restart sshd.service

[root@node1 ~]# systemctl restart sshd.service

[root@node1 ~]# systemctl restart sshd.service

 

在日志接受方:node2

vim /etc/rsyslog.conf

15,16行去掉注释开放通道

 

重启rsyslog

关闭防火墙

systemctl stop firewalld

systemctl disable firewalld

具体操作:

[root@node2 ~]# > /var/log/messages     清空日志

[root@node2 ~]# cat /var/log/messages

[root@node2 ~]# systemctl stop firewalld   关闭防火墙

[root@node2 ~]# systemctl disable firewalld

[root@node2 ~]# > /var/log/messages

[root@node2 ~]# cat /var/log/messages

[root@node2 ~]# cat /var/log/messages

Apr 14 01:06:51 node1 systemd: Stopping OpenSSH server daemon...

Apr 14 01:06:51 node1 systemd: Starting OpenSSH server daemon...

Apr 14 01:06:51 node1 systemd: Started OpenSSH server daemon.

基于Linux下的系统日志_第7张图片

3.定义日志采集格式:在日志接受方

vim /etc/rsyslog.conf

&template 格式名称,“日志采集格式"

*.info;mail.none;authpriv.none;cron.none                                                                 /var/log/messages格式名称

在rule底下编辑

$template westos,"%timegenerate% %FROMHOST-TP% %syslogtag% %msg%\n"

%timegenerate%        日志生成时间

%FROMHOST-TP%         日志来源主机

%syslogtag%           日志生成程序

%msg%                 日志内容

\n                    换行

 

[root@node2 ~]# vim /etc/rsyslog.conf

[root@node2 ~]# > /var/log/messages

[root@node2 ~]# cat /var/log/messages

Apr 14 01:24:59 node1 systemd: Stopping OpenSSH server daemon...

Apr 14 01:24:59 node1 systemd: Starting OpenSSH server daemon...

Apr 14 01:24:59 node1 systemd: Started OpenSSH server daemon.

在发送端只需要重启sshd看效果。

基于Linux下的系统日志_第8张图片

4.日志查看工具

journalctl         直接查看内存重的日志

journalctl -n 3    显示最新的前三行

基于Linux下的系统日志_第9张图片

journalctl -p err  显示报错信息

基于Linux下的系统日志_第10张图片

journalctl -f      实时监控命令,用ctrl+c结束监控

基于Linux下的系统日志_第11张图片

journalctl --since --until  例如journalctl --since 01:30 --until 01:40

基于Linux下的系统日志_第12张图片

journalctl -o verbose   查看日志的详细参数

基于Linux下的系统日志_第13张图片基于Linux下的系统日志_第14张图片

journalctl _pid=1248

基于Linux下的系统日志_第15张图片[root@node2 ~]# journalctl -n 3    查看前三行

-- Logs begin at Fri 2018-04-13 20:55:15 EDT, end at Sat 2018-04-14 01:52:18 E

Apr 14 01:52:18 node2.example.com dbus[516]: [system] Activating service name=

Apr 14 01:52:18 node2.example.com dbus-daemon[516]: dbus[516]: [system] Succes

Apr 14 01:52:18 node2.example.com dbus[516]: [system] Successfully activated s

[root@node2 ~]# journalctl -p err 查看报错

-- Logs begin at Fri 2018-04-13 20:55:15 EDT, end at Sat 2018-04-14 01:52:18 E

Apr 13 20:55:15 localhost kernel: Failed to access perfctr msr (MSR c1 is 0)

Apr 13 20:55:16 localhost rpcbind[171]: rpcbind terminating on signal. Restart

[root@node2 ~]# journalctl -f   监控命令,在另外一台虚拟机连接本台随便输入命令这边会有显示。

-- Logs begin at Fri 2018-04-13 20:55:15 EDT. --

Apr 14 01:40:01 node2.example.com systemd[1]: Starting Session 38 of user ....

Apr 14 01:40:01 node2.example.com systemd[1]: Started Session 38 of user root.

[root@node2 ~]# journalctl --since 01:30 --until 01:38  显示一点半到一点三十八的日志

-- Logs begin at Fri 2018-04-13 20:55:15 EDT, end at Sat 2018-04-14 01:54:07 E

Apr 14 01:30:01 node2.example.com systemd[1]: Starting Session 37 of user root

[root@node2 ~]# systemctl status sshd.service                    

查看sshd的状态

sshd.service - OpenSSH server daemon

   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)

   Active: active (running) since Sat 2018-04-14 01:00:57 EDT; 54min ago

 Main PID: 1972 (sshd)

   CGroup: /system.slice/sshd.service

           └─1972 /usr/sbin/sshd -D

 

Apr 14 01:00:57 node2.example.com systemd[1]: Starting OpenSSH server daem....

[root@node2 ~]# systemctl restart sshd.service       重启sshd

[root@node2 ~]# systemctl status sshd.service        再次查看sshd的状态

sshd.service - OpenSSH server daemon

   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)

   Active: active (running) since Sat 2018-04-14 01:56:06 EDT; 2s ago

  Process: 3216 ExecStartPre=/usr/sbin/sshd-keygen (code=exited, status=0/SUCCESS)

 Main PID: 3217 (sshd)重启之后PID发生变化。

   CGroup: /system.slice/sshd.service

           └─3217 /usr/sbin/sshd -D

 

Apr 14 01:56:06 node2.example.com systemd[1]: Starting OpenSSH server daem....

[root@node2 ~]# journalctl -o verbose     查看日志的详细参数

-- Logs begin at Fri 2018-04-13 20:55:15 EDT, end at Sat 2018-04-14 01:56:06 E

Fri 2018-04-13 20:55:15.713861 EDT [s=f3c65c31d1d04ad3b6ac6a35a742ecac;i=1;b=8

    PRIORITY=6

    _TRANSPORT=driver

[root@node2 ~]# journalctl _PID=3217    查看pid为3217的进程

-- Logs begin at Fri 2018-04-13 20:55:15 EDT, end at Sat 2018-04-14 01:58:27 EDT. --

Apr 14 01:56:06 node2.example.com sshd[3217]: Server listening on 0.0.0.0 port 22.

Apr 14 01:56:06 node2.example.com sshd[3217]: Server listening on :: port 22.

对systemd-journald管理

默认此程序只负责对日志进行查看而不对日志进行保存和采集。

那么关机后在开机,对日志进行查看,只能查看到开机后的日志,系统之前的日志因为是保存在内存中的,所以关机就清空了,那么在开机是用journalctl查看不到的。

如何让systemdjournald保存日志到硬盘中?

mkdir /var/log/journal

chgrp systemd-journald /var/log/journal

chmod g+s /var/log/journal

killall -1 systemd-journald   刷新

journalctl -n 3      显示最新的日志前三行

date  

redoot               重启查看效果

journalctl

[root@node2 ~]# journalctl -n 3     查看最新命令的三行

-- Logs begin at Fri 2018-04-13 20:55:15 EDT, end at Sat 2018-04-14 02:21:02 EDT. --

Apr 14 02:21:02 node2.example.com dbus[516]: [system] Activating service name='org.free

Apr 14 02:21:02 node2.example.com dbus-daemon[516]: dbus[516]: [system] Successfully ac

Apr 14 02:21:02 node2.example.com dbus[516]: [system] Successfully activated service 'o

lines 1-4/4 (END)

[root@node2 ~]# date

Sat Apr 14 02:21:20 EDT 2018

[root@node2 ~]# reboot          重启date命令之前的日志丢失

Connection to 172.25.254.221 closed by remote host.

Connection to 172.25.254.221 closed.

[kiosk@foundation21 Desktop]$ ssh [email protected]

[email protected]'s password:

Last login: Sat Apr 14 02:22:25 2018

[root@node2 ~]# journalctl -n 3

-- Logs begin at Sat 2018-04-14 02:21:52 EDT, end at Sat 2018-04-14 02:22:43 EDT. --

Apr 14 02:22:33 node2.example.com gnome-session[1164]: Window manager warning: Log leve

Apr 14 02:22:34 node2.example.com gnome-session[1164]: (tracker-miner-fs:1572): GLib-CR

基于Linux下的系统日志_第16张图片

[root@node2 ~]# mkdir /var/log/journal      建立组

[root@node2 ~]# chown root.systemd-journal /var/log/journal/    

更改用户组

[root@node2 ~]# ls -ld /var/log/journal/                        

查看

drwxr-xr-x. 2 root systemd-journal 6 Apr 14 02:25 /var/log/journal/

[root@node2 ~]# chmod 2755 /var/log/journal/                   

 赋予权限

[root@node2 ~]# ls -ld /var/log/journal/                        

查看权限

drwxr-sr-x. 2 root systemd-journal 6 Apr 14 02:25 /var/log/journal/

[root@node2 ~]# ps aux | grep systemd-journald

root       361  0.0  0.2  40864  2208 ?        Ss   02:21   0:00 /usr/lib/systemd/systemd-journald

root      1781  0.0  0.0 112644   940 pts/0    R+   02:28   0:00 grep --color=auto systemd-journald

[root@node2 ~]# killall -9 systemd-journald                刷新

[root@node2 ~]# ls /var/log/journal/

946cb0e817ea4adb916183df8c4fc817

[root@node2 ~]# cd 

/var/log/journal/946cb0e817ea4adb916183df8c4fc817/

[root@node2 946cb0e817ea4adb916183df8c4fc817]# ls

system.journal

[root@node2 946cb0e817ea4adb916183df8c4fc817]# file 

system.journal

system.journal: data

[root@node2 946cb0e817ea4adb916183df8c4fc817]# journalctl -n    

查看日志

-- Logs begin at Sat 2018-04-14 02:21:52 EDT, end at Sat 2018-04-14 02:30:02 EDT. --

Apr 14 02:26:34 node2.example.com dbus[513]: [system] Successfully activated service 'c

[root@node2 946cb0e817ea4adb916183df8c4fc817]# date

Sat Apr 14 02:31:08 EDT 2018

[root@node2 946cb0e817ea4adb916183df8c4fc817]# reboot     重启

Connection to 172.25.254.221 closed by remote host.

Connection to 172.25.254.221 closed.

[kiosk@foundation21 Desktop]$ ssh [email protected]

[email protected]'s password:

Last login: Sat Apr 14 02:22:30 2018 from 172.25.254.21

[root@node2 ~]# journalctl -n                              查看后关机之前的日志也保存在目录下

-- Logs begin at Sat 2018-04-14 02:28:45 EDT, end at Sat 2018-04-14 02:32:13 EDT. --

Apr 14 02:31:56 node2.example.com fprintd[1143]: Launching FprintObject

基于Linux下的系统日志_第17张图片

基于Linux下的系统日志_第18张图片

基于Linux下的系统日志_第19张图片


你可能感兴趣的:(基于Linux下的系统日志)