Linux学习（三十一）系统日志

Posted 2020-10-22 阮文武的网络日志

一、前言

linux的系统日志用的不多，我们就挑几个比较常用的大概讲一下。

二、分类讲解

2.1 /var/log/messages

这是个杂项日志，记录很多服务的日志。我们打开看一下。

系统日志会默认自动切割，比如在我的机器上就被切割成这样了：

[root@ruanwenwu-001 log]# ls /var/log/messages*
/var/log/messages           /var/log/messages-20171219  /var/log/messages-20180122
/var/log/messages-20171215  /var/log/messages-20171224

控制切割的配置文件是/etc/logrotate.conf

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp and btmp -- we\'ll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
        minsize 1M
    rotate 1
}
...

2.2 dmesg

这个命令的内容存放在内存中。之所以讲到这个命令，是因为当硬件出现故障时，会写日志到这里。

[root@ruanwenwu-001 log]# dmesg|head -n 10
[    0.000000] Initializing cgroup subsys cpuset
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.10.0-514.el7.x86_64 ([e-mail]) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC) ) #1 SMP Tue Nov 22 16:42:41 UTC 2016
[    0.000000] Command line: BOOT_IMAGE=/vmlinuz-3.10.0-514.el7.x86_64 root=UUID=604bc673-7f8d-4355-919f-ed6740a8efc8 ro crashkernel=auto rhgb quiet LANG=zh_CN.UTF-8
[    0.000000] Disabled fast string operations
[    0.000000] e820: Bios-provided physical RAM map:
[    0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009ebff] usable
[    0.000000] BIOS-e820: [mem 0x000000000009ec00-0x000000000009ffff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000000dc000-0x00000000000fffff] reserved

注意/var/log/dmesg和dmesg没有任何关系。/var/log/dmesg存放系统的一些启动日志。

2.3 last

last命令用来记录服务器上的成功登陆。

[root@ruanwenwu-001 log]# last|head -n 10
root     pts/0        192.168.38.1     Wed Jan 24 17:23   still logged in   
root     pts/0        192.168.38.1     Wed Jan 24 17:23 - 17:23  (00:00)    
root     pts/2        192.168.38.1     Mon Jan 22 15:22 - 16:19 (2+00:57)   
root     pts/3        192.168.38.1     Mon Jan 22 15:22 - 15:22  (00:00)    
root     pts/2        192.168.38.1     Mon Jan 22 15:21 - 15:22  (00:00)    
root     pts/1        192.168.38.1     Mon Jan 22 15:16 - 18:00  (02:43)    
root     pts/0        192.168.38.1     Tue Dec 26 15:53 - 17:56 (27+02:03)  
root     tty1                          Tue Dec 26 09:03   still logged in   
reboot   system boot  3.10.0-514.el7.x Tue Dec 26 09:03 - 18:03 (29+09:00)  
root     pts/1        192.168.38.1     Sun Dec 24 12:16 - 17:47  (05:31)   

last命令实际上调用的是/var/log/wtmp。

2.4 lastb

lastb用来记录失败的登录。

[root@ruanwenwu-001 log]# lastb|head -n 10
root     pts/2                         Wed Jan 24 11:44 - 11:44  (00:00)    
root     pts/2                         Wed Jan 24 11:44 - 11:44  (00:00)    
root     pts/2                         Wed Jan 24 11:43 - 11:43  (00:00)    

当我们的服务器遭遇到暴力破解时，就要看看这里了。

2.5 /var/log/secure

系统的安全日志。比如我们登录成功和失败，都会在这里记录。