linux系统日志

Posted 2020-10-23

##日志记录系统每天发生的各种各样的事情，比如监控系统的状况，排查系统的故障等。你可以通过日志来检查错误发生的原因，或者受到攻击时留下的痕迹。日志的主要功能是审计和监测，还有实时的监测系统状态，监测和追踪入侵者

## 经常查看的系统文件是 /var/log/message,它是系统核心日志文件

Linux系统日志

./var/log/messages

./etc/logrotate.conf 日志分割文件

./var/log/dmesg

./last 命令，调用的是/var/log/wtmp

./lastb命令查看登录失败的用户，对应的文件是/var/log/btmp

./var/logsecure

/var/log/messages  这个是经常查看的日志文件  核心系统日志文件，包含启动时间的引导消息，以及系统运行的其他状态消息，I/O错误 网络错误和其他系统错误都会记录到这个文件下

[[email protected] ~]# less /var/log/messages    #查看系统日志文件的信息
Jan 29 07:01:01 yzllinux123 systemd: Started Session 3 of user root.
Jan 29 07:01:01 yzllinux123 systemd: Starting Session 3 of user root.
Jan 29 07:12:33 yzllinux123 systemd-logind: Removed session 1.
Jan 29 07:12:33 yzllinux123 systemd: Removed slice User Slice of root.
Jan 29 07:12:33 yzllinux123 systemd: Stopping User Slice of root.
Jan 29 07:12:40 yzllinux123 systemd: Created slice User Slice of root.
Jan 29 07:12:40 yzllinux123 systemd: Starting User Slice of root.
Jan 29 07:12:40 yzllinux123 systemd: Started Session 4 of user root.
Jan 29 07:12:40 yzllinux123 systemd-logind: New session 4 of user root.

/etc/logrotate.conf  #日志切割配置文件

[[email protected] ~]# cat /etc/logrotate.conf  #查看日志切割配置文件内容
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
 minsize 1M
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

# system-specific logs may be also be configured here.

[[email protected] ~]# cat /etc/logrotate.conf  #查看日志切割配置文件
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
 minsize 1M
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

# system-specific logs may be also be configured here.

[[email protected] ~]# du -sh /etc/logrotate.conf   #du -sh 查看切割文件的大小
4.0K /etc/logrotate.conf

dmesg 命令  它可以显示系统的启动信息，如果你的某个硬件有问题（比如有网卡），这个命令也可以看到

[[email protected] ~]# dmesg |head   #列出系统硬件信息
[    0.000000] Initializing cgroup subsys cpuset
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.10.0-123.el7.x86_64 ([email protected]) (gcc version 4.8.2 20140120 (Red Hat 4.8.2-16) (GCC) ) #1 SMP Mon Jun 30 12:09:22 UTC 2014
[    0.000000] Command line: BOOT_IMAGE=/vmlinuz-3.10.0-123.el7.x86_64 root=UUID=50cdeab8-cfd2-475a-b77a-8f9e904b4fa6 ro vconsole.keymap=us crashkernel=auto vconsole.font=latarcyrheb-sun16 rhgb quiet.UTF-8
[    0.000000] Disabled fast string operations
[    0.000000] e820: Bios-provided physical RAM map:
[    0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009efff] usable
[    0.000000] BIOS-e820: [mem 0x000000000009f000-0x000000000009ffff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000000ca000-0x00000000000cbfff] reserved
[[email protected] ~]# ^C

/var/log/dmesg  日志  #  记录系统启动的日志

[[email protected] ~]# cat /var/log/dmesg |head    #系统启动日志
[    0.000000] Initializing cgroup subsys cpuset
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.10.0-123.el7.x86_64 ([email protected]) (gcc version 4.8.2 20140120 (Red Hat 4.8.2-16) (GCC) ) #1 SMP Mon Jun 30 12:09:22 UTC 2014
[    0.000000] Command line: BOOT_IMAGE=/vmlinuz-3.10.0-123.el7.x86_64 root=UUID=50cdeab8-cfd2-475a-b77a-8f9e904b4fa6 ro vconsole.keymap=us crashkernel=auto vconsole.font=latarcyrheb-sun16 rhgb quiet.UTF-8
[    0.000000] Disabled fast string operations
[    0.000000] e820: BIOS-provided physical RAM map:
[    0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009efff] usable
[    0.000000] BIOS-e820: [mem 0x000000000009f000-0x000000000009ffff] reserved
[    0.000000] BIOS-e820: [mem 0x00000000000ca000-0x00000000000cbfff] reserved

last 命令  查看正确的登录

[[email protected] ~]# last |head  #查看正确的登录历史  谁 怎么登录 时间 等
root     pts/0        192.168.12.1     Thu Feb  1 05:00   still logged in  
reboot   system boot  3.10.0-123.el7.x Thu Feb  1 04:59 - 06:04  (01:05)   
root     pts/0        192.168.12.1     Mon Jan 29 07:12 - crash (2+21:46)  
root     pts/0        192.168.12.1     Mon Jan 29 05:01 - 07:12  (02:10)   
reboot   system boot  3.10.0-123.el7.x Mon Jan 29 05:01 - 06:04 (3+01:03)  
root     pts/0        192.168.12.1     Fri Jan 26 08:00 - crash (2+21:00)  
reboot   system boot  3.10.0-123.el7.x Fri Jan 26 07:58 - 06:04 (5+22:05)  
root     tty1                          Fri Jan 26 07:58 - 07:58  (00:00)   
root     pts/0        192.168.12.1     Fri Jan 26 07:29 - down   (00:28)   
reboot   system boot  3.10.0-123.el7.x Fri Jan 26 07:28 - 07:58  (00:29)

lastb  #记录的是登录失败的信息

[[email protected] ~]# lastb |head  #登录错误的信息

btmp begins Thu Feb  1 05:32:02 2018

/var/log/secure  #记录验证和授权等方面的信息

[[email protected] ~]# cat /var/log/secure
Jan 29 07:12:33 yzllinux123 sshd[2131]: pam_unix(sshd:session): session closed for user root
Jan 29 07:12:40 yzllinux123 sshd[2538]: Accepted password for root from 192.168.12.1 port 52861 ssh2
Jan 29 07:12:40 yzllinux123 sshd[2538]: pam_unix(sshd:session): session opened for user root by (uid=0)
Feb  1 04:59:25 yzllinux123 polkitd[677]: Loading rules from directory /etc/polkit-1/rules.d
Feb  1 04:59:25 yzllinux123 polkitd[677]: Loading rules from directory /usr/share/polkit-1/rules.d
Feb  1 04:59:25 yzllinux123 polkitd[677]: Finished loading, compiling and executing 2 rules
Feb  1 04:59:25 yzllinux123 polkitd[677]: Acquired the name org.freedesktop.PolicyKit1 on the system bus
Feb  1 04:59:31 yzllinux123 sshd[1107]: Server listening on 0.0.0.0 port 22.
Feb  1 04:59:31 yzllinux123 sshd[1107]: Server listening on :: port 22.
Feb  1 05:00:11 yzllinux123 sshd[2128]: Accepted password for root from 192.168.12.1 port 51159 ssh2
Feb  1 05:00:11 yzllinux123 sshd[2128]: pam_unix(sshd:session): session opened for user root by (uid=0)

screen 工具  (虚拟终端)

为了不让一个任务中断 除了我们一直在线  还可以把任务丢在后台运行  使用：nohup +运行的日志 +&

还有一个办法 就是 screen  虚拟终端

首先我们需要安装screen  # yum install -y screen

安装完成之后，我们只需要输入#screen  然后回车 就进入虚拟终端

然后按Ctrl +A键 在按d 键退出screen会话

#screen -ls #是查看已经打开的screen 会话

#screen -r +编号  #是再次打开screen会话

#exit 是结束screen会话