Benutzer-Werkzeuge
lpi1:logging
Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen gezeigt.
|
lpi1:logging [2011/11/23 09:41] 127.0.0.1 Externe Bearbeitung |
lpi1:logging [2018/07/05 14:23] |
||
|---|---|---|---|
| Zeile 1: | Zeile 1: | ||
| - | ====== syslog ====== | ||
| - | Beispiel: Logdaten von einem Rechner auf den nächsten übertragen | ||
| - | |||
| - | ===== Zielrechner: ===== | ||
| - | Zielrechner netzwerkfähig machen: | ||
| - | |||
| - | ''/etc/sysconfig/syslog'' : ( Centos 5 ) | ||
| - | <file> | ||
| - | SYSLOGD_OPTIONS="-m 0 -r" | ||
| - | </file> | ||
| - | |||
| - | ''/etc/sysconfig/syslog'': ( openSuSE 11.1 ) | ||
| - | <code bash> | ||
| - | SYSLOGD_PARAMS="-r" | ||
| - | </code> | ||
| - | |||
| - | ''/etc/default/syslogd'': ( debian 4.0 ) | ||
| - | <code bash> | ||
| - | SYSLOGD="-r" | ||
| - | </code> | ||
| - | |||
| - | Passende Nachrichten in Datei '/var/log/beispiel' schreiben: | ||
| - | |||
| - | ''/etc/syslog.conf'' : | ||
| - | <file> | ||
| - | local5.info -/var/log/beispiel | ||
| - | </file> | ||
| - | |||
| - | Syslog neu starten: | ||
| - | /etc/init.d/sysklogd restart | ||
| - | |||
| - | ===== Absender-Rechner: ===== | ||
| - | /etc/syslog.conf: | ||
| - | local5.info @zielrechner | ||
| - | |||
| - | Syslog neu einlesen: | ||
| - | /etc/init.d/sysklogd restart | ||
| - | |||
| - | Testen: Meldung abschicken: | ||
| - | logger -p local5.info "Testmeldung" | ||
| - | |||
| - | ====== rsyslog ====== | ||
| - | Beispiel: Logdaten von einem Rechner auf den nächsten übertragen | ||
| - | |||
| - | |||
| - | ===== Zielrechner: ===== | ||
| - | Zielrechner netzwerkfähig machen: | ||
| - | Passende Nachrichten in Datei '/var/log/beispiel' schreiben: | ||
| - | |||
| - | === Debian === | ||
| - | ''/etc/rsyslog.conf'': ( debian 5.0 ) | ||
| - | <file> | ||
| - | $ModLoad imudp | ||
| - | $UDPServerRun 514 | ||
| - | local5.info -/var/log/beispiel | ||
| - | </file> | ||
| - | |||
| - | Syslog neu starten: | ||
| - | /etc/init.d/rsyslog restart | ||
| - | |||
| - | === SuSE === | ||
| - | ''/etc/rsyslog.d/remote.conf'': ( sles 11 SP 1 ) | ||
| - | <file> | ||
| - | $ModLoad imudp | ||
| - | $UDPServerRun 514 | ||
| - | </file> | ||
| - | ''/etc/rsyslog.conf'': ( debian 5.0 ) | ||
| - | |||
| - | <file> | ||
| - | local5.info -/var/log/beispiel | ||
| - | </file> | ||
| - | |||
| - | Syslog neu starten: | ||
| - | /etc/init.d/syslog restart | ||
| - | |||
| - | ===== Absender-Rechner: ===== | ||
| - | /etc/rsyslog.conf: | ||
| - | local5.info @zielrechner | ||
| - | |||
| - | Syslog neu einlesen: | ||
| - | /etc/init.d/rsyslog restart | ||
| - | |||
| - | Testen: Meldung abschicken: | ||
| - | logger -p local5.info "Testmeldung" | ||
| - | |||
| - | ====== syslog-ng ====== | ||
| - | Beispiel: Eine eigene log-Regel schreiben: | ||
| - | |||
| - | ''/etc/syslog-ng/syslog-ng.conf.in'': (SuSE bis 10.1) | ||
| - | |||
| - | ''/etc/syslog-ng/syslog-ng.conf'': (SuSE ab 10.2) | ||
| - | <file> | ||
| - | filter f_ingo { | ||
| - | level(warn) and program(logger); | ||
| - | }; | ||
| - | destination ingo_log { | ||
| - | file("/var/log/ingo.log"); | ||
| - | }; | ||
| - | log { | ||
| - | source(src); | ||
| - | filter(f_ingo); | ||
| - | destination(ingo_log); | ||
| - | }; | ||
| - | </file> | ||
| - | Configdatei überprüfen: | ||
| - | syslog-ng -s | ||
| - | |||
| - | Dienst neu starten und evtl. SuSEconfig glücklich machen | ||
| - | /sbin/conf.d/SuSEconfig.syslog-ng | ||
| - | /etc/init.d/syslog restart | ||
| - | |||
| - | Testen: | ||
| - | logger -p local1.warn -t logger "Dies ist eine Testmeldung" | ||
| - | |||
| - | Beispiel: Logdaten von einem Rechner auf den nächsten übertragen | ||
| - | |||
| - | ===== Zielrechner: ===== | ||
| - | Zielrechner netzwerkfähig machen : | ||
| - | |||
| - | ''/etc/syslog-ng/syslog-ng.conf.in'': (SuSE bis 10.1) | ||
| - | |||
| - | ''/etc/syslog-ng/syslog-ng.conf'': (SuSE ab 10.2) | ||
| - | |||
| - | <file> | ||
| - | source src{ | ||
| - | |||
| - | ... | ||
| - | |||
| - | udp(ip("0.0.0.0") port(514)); | ||
| - | |||
| - | }; | ||
| - | </file> | ||
| - | |||
| - | Meldungen bestimmter Log-Facilities und Log-Priorities werden durch Filter und Destination definiert | ||
| - | |||
| - | <file> | ||
| - | filter f_local5 { | ||
| - | level(info) and facility(local5); | ||
| - | }; | ||
| - | |||
| - | destination d_local5 { | ||
| - | file("/var/log/beispiel"); | ||
| - | }; | ||
| - | |||
| - | log { | ||
| - | source(src) ; | ||
| - | filter(f_local5) ; | ||
| - | destination(d_local5); | ||
| - | }; | ||
| - | </file> | ||
| - | |||
| - | Danach ''SuSEconfig'' oder ''/sbin/conf.d/SuSEconfig.syslog-ng'' aufrufen um die Änderungen permanent zu übertragen und syslog-ng reloaden. | ||
| - | |||
| - | rcsyslog reload | ||
| - | |||
| - | ===== Absender-Rechner ===== | ||
| - | ''/etc/syslog-ng/syslog-ng.conf.in'': (SuSE bis 10.1) | ||
| - | |||
| - | ''/etc/syslog-ng/syslog-ng.conf'': (SuSE ab 10.2) | ||
| - | |||
| - | <file> | ||
| - | destination d_ziel { udp( "Zielrechner" port(514) ); }; | ||
| - | |||
| - | log { source(src); destination(d_ziel); }; | ||
| - | </file> | ||
| - | |||
| - | ''SuSEconfig'' aufrufen zum Ändern der Konfigdatei und syslog reloaden | ||
| - | |||
| - | rcsyslog reload | ||
| - | |||
| - | |||
| - | ====== User Logging ====== | ||
| - | |||
| - | paket psacct installieren. | ||
| - | |||
| - | Log aktivieren | ||
| - | <code> | ||
| - | touch acct.log | ||
| - | accton acct.log | ||
| - | </code> | ||
| - | |||
| - | Log deaktivieren | ||
| - | <code> | ||
| - | accton | ||
| - | </code> | ||
| - | |||
| - | |||
| - | Logs auswerten | ||
| - | <code> | ||
| - | sa -a acct.log | ||
| - | lastcomm -f acct.log --user nutzer14 | ||
| - | </code> | ||
| - | |||
| - | ====== logrotate ====== | ||
| - | siehe [[logrotate]] | ||
| - | ====== logs auswerten ====== | ||
| - | Debian: | ||
| - | logcheck | ||
| - | |||
| - | SuSE: | ||
| - | logdigest | ||
| - | logwatch | ||
| - | |||
| - | CentOS 5: | ||
| - | logwatch | ||
| - | |||
| - | ==== Log Analyse Software ==== | ||
| - | * http://www.8pussy.org | ||
| - | * http://loganalyzer.adiscon.com | ||
| - | * http://www.splunk.com ( proprietär ) | ||
| - | |||
| - | ====== Doku ====== | ||
| - | * Level: | ||
| - | ''debug, info, notice, warning, warn (same as warning), err, error (same as err), crit, alert, emerg, panic (same as emerg)'' | ||
| - | * Facility: | ||
| - | ''auth, authpriv, cron, daemon, kern, lpr, mail, mark, news, security (same as auth), syslog, user, uucp and local0 through local7'' | ||
| - | |||
| - | ====== Links ====== | ||
| - | |||
| - | |||
| - | |||
| - | |||
| - | ===== Syslog ===== | ||
| - | * http://de.linwiki.org/wiki/Linuxfibel_-_System-Administration_-_Protokollierung | ||
| - | |||
| - | ===== Syslog-NG ===== | ||
| - | * http://www.linux-magazin.de/Artikel/ausgabe/2003/11/tagebuch/tagebuch.html | ||
| - | * http://www.wikidorf.de/reintechnisch/Inhalt/SyslogNGEinfuehrung | ||
| - | * http://www.balabit.com/products/syslog_ng/reference-1.6/syslog-ng.html/book1.html | ||
lpi1/logging.txt · Zuletzt geändert: 2018/07/05 14:23 (Externe Bearbeitung)
Seiten-Werkzeuge
Falls nicht anders bezeichnet, ist der Inhalt dieses Wikis unter der folgenden Lizenz veröffentlicht: CC Attribution-Noncommercial-Share Alike 4.0 International
