Linux的系统日志相关管理

爱被打了一巴掌 2022-04-22 15:40 252阅读 0赞

### 1. 系统日志管理 ###

rsyslog

此服务是用来采集系统日志的，它不产生日志，只是起到采集作用

#### rsyslog的管理 ####

<table> 
 <thead> 
  <tr> 
   <th>文件</th> 
   <th>用法</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>/var/log/messages</td> 
   <td>服务信息日志</td> 
  </tr> 
  <tr> 
   <td>/var/log/secure</td> 
   <td>系统登录日志</td> 
  </tr> 
  <tr> 
   <td>/var/log/cron</td> 
   <td>定时任务日志</td> 
  </tr> 
  <tr> 
   <td>/var/log/maillog</td> 
   <td>邮件日志</td> 
  </tr> 
  <tr> 
   <td>/var/log/boot.log</td> 
   <td>系统启动日志</td> 
  </tr> 
 </tbody> 
</table>

*以上各文件*

![在这里插入图片描述][20190114180631297.png]

--------------------

#### 指定日志采集路径 ####

<table> 
 <thead> 
  <tr> 
   <th>格式</th> 
   <th>内容导向</th> 
   <th>操作目的</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>什么类型的日志 <strong>.</strong> 什么级别的日志</td> 
   <td>/var/log/file</td> 
   <td>日志采集</td> 
  </tr> 
 </tbody> 
</table>

*具体体现如下*  
![在这里插入图片描述][2019011418135620.png]

--------------------

### 2. 日志类型种类 ###

<table> 
 <thead> 
  <tr> 
   <th>名称</th> 
   <th>来源</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>auth</td> 
   <td>pam产生的日志</td> 
  </tr> 
  <tr> 
   <td>authpriv</td> 
   <td>ssh,ftp等登录信息的验证信息</td> 
  </tr> 
  <tr> 
   <td>cron</td> 
   <td>时间任务相关</td> 
  </tr> 
  <tr> 
   <td>kern</td> 
   <td>内核</td> 
  </tr> 
  <tr> 
   <td>lpr</td> 
   <td>打印</td> 
  </tr> 
  <tr> 
   <td>mail</td> 
   <td>邮件</td> 
  </tr> 
  <tr> 
   <td>mark(syslog)-rsyslog</td> 
   <td>服务内部的信息，时间标识</td> 
  </tr> 
  <tr> 
   <td>news</td> 
   <td>新闻组</td> 
  </tr> 
  <tr> 
   <td>user</td> 
   <td>用户程序产生的相关信息</td> 
  </tr> 
  <tr> 
   <td>uucp</td> 
   <td>unix to unix copy,unix主机之间相关的通讯</td> 
  </tr> 
  <tr> 
   <td>local 1～7</td> 
   <td></td> 
  </tr> 
 </tbody> 
</table>

*此类可在/etc/rsyslog.conf中找到*

![在这里插入图片描述][20190114184609482.png]

--------------------

### 3.日志级别分类 ###

<table> 
 <thead> 
  <tr> 
   <th>名称</th> 
   <th>意义</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>debug</td> 
   <td>有调试信息的，日志信息最多</td> 
  </tr> 
  <tr> 
   <td>info</td> 
   <td>一般信息的日志，最常用</td> 
  </tr> 
  <tr> 
   <td>notice</td> 
   <td>最具有重要性的普通条件的信息</td> 
  </tr> 
  <tr> 
   <td>warning</td> 
   <td>警告级别</td> 
  </tr> 
  <tr> 
   <td>err</td> 
   <td>错误级别，阻止某个功能或者模块不能正常工作的信息</td> 
  </tr> 
  <tr> 
   <td>crit</td> 
   <td>严重级别，阻止整个系统或者整个软件不能正常工作的信息</td> 
  </tr> 
  <tr> 
   <td>alert</td> 
   <td>需要立刻修改的信息</td> 
  </tr> 
  <tr> 
   <td>emerg</td> 
   <td>内核奔溃等严重信息</td> 
  </tr> 
  <tr> 
   <td>none</td> 
   <td>什么都不记录</td> 
  </tr> 
 </tbody> 
</table>

\*\*⚠注意：\*\*从上到下，级别从低到高，记录的信息越来越少

**详细的可以查看手册：man 3 syslog**

*具体体现如下*

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70]

--------------------

### 4.日志的远程同步 ###

#### 在日志发送方： ####

vim /etc/rsyslog.conf
    =====================
    *.*		@172.25.254.120					##"@"表示UDP协议发送，"@@"表示TCP协议发送
    systemctl restart rsyslog

*具体如下*

![在这里插入图片描述][20190114184227839.png]

#### 在日志接收方： ####

vim /etc/rsyslog.conf 
    =====================
     15 $ModLoad imudp						##日志接收模块
     16 $UDPServerRun 514					##开启接收端口
    =====================
    systemctl restart rsyslog.service
    systemctl stop firewalld.service 		##关闭火墙
    systemctl disable firewalld.service		##设定火墙开机启动

*具体如下*

![在这里插入图片描述][20190114183946916.png]

![在这里插入图片描述][20190114183905253.png]

#测试
    
    在发送方和接收方都清空日志文件
     > /var/log/messages
    
    在日志接收方
    logger hahahahahahaha
    cat /var/log/messages 					##查看日志已经生成

*发送信息“hahahahaha”*

![在这里插入图片描述][20190114184333469.png]

*重启服务，关闭防火墙，清空日志，查看刷新后的日志*

![在这里插入图片描述][20190114183601106.png]

*发送的信息已经收到*

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 1]

--------------------

### 5.日志采集格式的设定 ###

vim /etc/rsyslog.conf
    =====================
    $template LOGFMT, "%timegenerated% %FROMHOST-IP% %syslogtag% %msg% \n"
    
    %timegenerated%			##显示日志时间
    %FROMHOST-IP%			##显示主机ip
    %syslogtag%			##日志记录目标
    %msg%				##日志内容
    \n				##换行
    
    *.*                                                     /var/log/well;LOGFMT
    ==================
    cat /var/log/well

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 2]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 3]

--------------------

### 6.时间同步服务 ###

服务名称

`chronyd`

#### 部署 ####

##### 服务端： #####

vim /etc/chrony.conf 
    ====================
    22 allow 172.25.254.170/24
    29 local stratum 10
    ===================
    systemctl restart chronyd.service
    date 11111111
    Mon Nov 11 11:11:00 EST 2019
    ============================
    timedatectl set-timezone Asia/Shanghai

*修改/etc/chrony.conf 文件*

![在这里插入图片描述][2019011621341363.png]

*重启服务,修改时间*

![在这里插入图片描述][20190116213726964.png]

##### 客户端 #####

vim /etc/chrony.conf
    ====================
    server 172.25.254.170 iburst	 ##本机立即同步170主机的时间

![在这里插入图片描述][20190116215552345.png]

#### 测试 ####

##### 在客户端 #####

[root@client_ssh ~]# chronyc sources -v
    =======================================
    210 Number of sources = 1
    
      .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
     / .- Source state '*' = current synced, '+' = combined , '-' = not combined,
    | /   '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
    ||                                                 .- xxxx [ yyyy ] +/- zzzz
    ||                                                /   xxxx = adjusted offset,
    ||         Log2(Polling interval) -.             |    yyyy = measured offset,
    ||                                  \            |    zzzz = estimated error.
    ||                                   |           |                         
    MS Name/IP address         Stratum Poll Reach LastRx Last sample
    ===============================================================================
    ^? 172.25.254.170                0   7     0   10y     +0ns[   +0ns] +/-    0ns

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 4]

--------------------

### 7. 时间系统管理命令 ###

#### timedatectl ####

<table> 
 <thead> 
  <tr> 
   <th>命令</th> 
   <th>用法</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>timedatectl</td> 
   <td>管理系统时间</td> 
  </tr> 
  <tr> 
   <td>timedatectl status</td> 
   <td>显示当前时间信息</td> 
  </tr> 
  <tr> 
   <td>timedatectl set-time</td> 
   <td>设定当前时间</td> 
  </tr> 
  <tr> 
   <td>timedatectl set-timezone</td> 
   <td>设定当前时区</td> 
  </tr> 
  <tr> 
   <td>timedatectl set-local-rtc 0/1</td> 
   <td>设定是否使用utc时间</td> 
  </tr> 
  <tr> 
   <td>timedatectl list-timezone</td> 
   <td>查看支持的所有时区</td> 
  </tr> 
 </tbody> 
</table>

*管理系统时间*

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 5]

*显示当前时间信息*

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 6]

*设定当前时间*

![在这里插入图片描述][2019011622042822.png]

*设定当前时区*

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 7]

*查看支持的所有时区*

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 8]

--------------------

### 8. 系统日志管理命令 ###

#### journal命令 ####

<table> 
 <thead> 
  <tr> 
   <th>命令</th> 
   <th>用法</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>journalctl</td> 
   <td>日志查看工具</td> 
  </tr> 
  <tr> 
   <td>journalctl -n 3</td> 
   <td>查看最近3条日志</td> 
  </tr> 
  <tr> 
   <td>journalctl -p err</td> 
   <td>查看错误日志</td> 
  </tr> 
  <tr> 
   <td>journalctl -o verbose</td> 
   <td>查看日志的详细系数</td> 
  </tr> 
  <tr> 
   <td>journalctl --since</td> 
   <td>查看从什么时间开始的日志</td> 
  </tr> 
  <tr> 
   <td>journalctl --until</td> 
   <td>查看到什么时间为止的日志</td> 
  </tr> 
 </tbody> 
</table>

*日志查看工具*

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 9]

*查看最近3条日志*

![在这里插入图片描述][20190116220653907.png]

*查看错误日志*

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 10]

*查看日志的详细系数*

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 11]

*查看日志起始时间*

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 12]

*查看日志结束时间*

![在这里插入图片描述][20190116220959406.png]

#### 如何使用systemd-journald保存系统日志 ####

默认`systemd-journald`是不保存系统日志到硬盘的  
那么关机后再次开机只能看到本次开机之后的日志  
上一次关机之前的日志是无法查看的

mkdir /var/log/journal
    chgrp systemd-journal /var/log/journal
    chomd g+s /var/log/journal
    killall -1 systemd-journald
     ls /var/log/journal/
    =====================
    946cb0e817ea4adb916183df8c4fc817

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 13]

系统日志管理目前整理了这些，记录于此以便后边学习回顾。

[20190114180631297.png]: /images/20220327/2190da79ac65487c8bdf4a97d0256634.png
[2019011418135620.png]: /images/20220327/7b0c621e2d3246ba9abb7629aa8eaf8b.png
[20190114184609482.png]: /images/20220327/6ab872ad30f84a02a0335152d194e3a3.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70]: /images/20220327/cfb71244aadf4147b2cfc8f70a441369.png
[20190114184227839.png]: /images/20220327/fcacea8e4b1f4853be2596f91d95dc2f.png
[20190114183946916.png]: /images/20220327/19718e8622ff4ae2ae0a6c23035b23f7.png
[20190114183905253.png]: /images/20220327/dd5328ca109b4540b891cf92eca3c3da.png
[20190114184333469.png]: /images/20220327/65ef90a3365d42c19bac5530699e1e38.png
[20190114183601106.png]: /images/20220327/fb91ea1b91db4ca2bc1ce60de9937127.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 1]: /images/20220327/eaa752fc95764912b9f50b4ffbb84d52.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 2]: /images/20220327/345d1504f3bd40a1847eee161f41305d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 3]: /images/20220327/0d165ccc4a39441d85d4b125b7ffbc3a.png
[2019011621341363.png]: /images/20220327/0647a92f0fe54980b848a407d62e1c7d.png
[20190116213726964.png]: /images/20220327/889834df6c6f40e5a911e31ea30a5533.png
[20190116215552345.png]: /images/20220327/501b6ab80be34f41a7a0bea5676e95b7.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 4]: /images/20220327/d367045b249f4192b00dc8a6baa08252.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 5]: /images/20220327/3963b46f1d5a49b4a4f4aac982f3f03f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 6]: /images/20220327/9a5aca3704e4463db59554b25b6546ba.png
[2019011622042822.png]: /images/20220327/f90da6e32b81446eb6468d09cd0e603f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 7]: /images/20220327/6da73691c55a4c31a59beb8836fac269.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 8]: /images/20220327/f241f74057d640869c626b95b8710bc2.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 9]: /images/20220327/d1b0242e71f4487b94053829b3c6dc82.png
[20190116220653907.png]: /images/20220327/500a397e225744bdb161b37796537a21.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 10]: /images/20220327/3e576ea5cf054feb92aa9eb97d5ddb24.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 11]: /images/20220327/8502f187bb2940b0b1fd63b26aa16950.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 12]: /images/20220327/1b697ba9de4d4c61b9a23ea95d05b136.png
[20190116220959406.png]: /images/20220327/0b4acb34d0c0436db1e256dd331fdb78.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNTcwMzY5_size_16_color_FFFFFF_t_70 13]: /images/20220327/8aa14f48816645589191200219282860.png