一,前言
linux 的系统日志用的不多,我们就挑几个比较常用的大概讲一下.
二,分类讲解
2.1 /var/log/messages
这是个杂项日志,记录很多服务的日志.我们打开看一下.
系统日志会默认自动切割,比如在我的机器上就被切割成这样了:
[root@ruanwenwu-001 log]# ls /var/log/messages*
/var/log/messages /var/log/messages-20171219 /var/log/messages-20180122
/var/log/messages-20171215 /var/log/messages-20171224
控制切割的配置文件是 / etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# use date as a suffix of the rotated file
dateext
# uncomment this if you want your log files compressed
#compress
# RPM packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
minsize 1M
rotate 1
}
...
2.2 dmesg
这个命令的内容存放在内存中.之所以讲到这个命令,是因为当硬件出现故障时,会写日志到这里.
[root@ruanwenwu-001 log]# dmesg|head -n 10
[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 3.10.0-514.el7.x86_64 (builder@kbuilder.dev.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC) ) #1 SMP Tue Nov 22 16:42:41 UTC 2016
[ 0.000000] Command line: BOOT_IMAGE=/vmlinuz-3.10.0-514.el7.x86_64 root=UUID=604bc673-7f8d-4355-919f-ed6740a8efc8 ro crashkernel=auto rhgb quiet LANG=zh_CN.UTF-8
[ 0.000000] Disabled fast string operations
[ 0.000000] e820: BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009ebff] usable
[ 0.000000] BIOS-e820: [mem 0x000000000009ec00-0x000000000009ffff] reserved
[ 0.000000] BIOS-e820: [mem 0x00000000000dc000-0x00000000000fffff] reserved
注意 / var/log/dmesg 和 dmesg 没有任何关系./var/log/dmesg 存放系统的一些启动日志.
2.3 last
last 命令用来记录服务器上的成功登陆.
[root@ruanwenwu-001 log]# last|head -n 10
root pts/0 192.168.38.1 Wed Jan 24 17:23 still logged in
root pts/0 192.168.38.1 Wed Jan 24 17:23 - 17:23 (00:00)
root pts/2 192.168.38.1 Mon Jan 22 15:22 - 16:19 (2+00:57)
root pts/3 192.168.38.1 Mon Jan 22 15:22 - 15:22 (00:00)
root pts/2 192.168.38.1 Mon Jan 22 15:21 - 15:22 (00:00)
root pts/1 192.168.38.1 Mon Jan 22 15:16 - 18:00 (02:43)
root pts/0 192.168.38.1 Tue Dec 26 15:53 - 17:56 (27+02:03)
root tty1 Tue Dec 26 09:03 still logged in
reboot system boot 3.10.0-514.el7.x Tue Dec 26 09:03 - 18:03 (29+09:00)
root pts/1 192.168.38.1 Sun Dec 24 12:16 - 17:47 (05:31)
last 命令实际上调用的是 / var/log/wtmp.
2.4 lastb
lastb 用来记录失败的登录.
[root@ruanwenwu-001 log]# lastb|head -n 10
root pts/2 Wed Jan 24 11:44 - 11:44 (00:00)
root pts/2 Wed Jan 24 11:44 - 11:44 (00:00)
root pts/2 Wed Jan 24 11:43 - 11:43 (00:00)
当我们的服务器遭遇到暴力破解时,就要看看这里了.
2.5 /var/log/secure
系统的安全日志.比如我们登录成功和失败,都会在这里记录.
来源: http://www.bubuko.com/infodetail-2473634.html