mirror of
https://github.com/LCTT/TranslateProject.git
synced 2025-01-25 23:11:02 +08:00
[Translated] tech/RHCE/Part 5 - How to Manage System Logs (Configure, Rotate and Import Into Database) in RHEL 7.md
This commit is contained in:
Luoyuanhao
parent
28af00eb8a
commit
f61c12b96c
@ -1,166 +0,0 @@
|
||||
ictlyh Translating
|
||||
Part 5 - How to Manage System Logs (Configure, Rotate and Import Into Database) in RHEL 7
|
||||
================================================================================
|
||||
In order to keep your RHEL 7 systems secure, you need to know how to monitor all of the activities that take place on such systems by examining log files. Thus, you will be able to detect any unusual or potentially malicious activity and perform system troubleshooting or take another appropriate action.
|
||||
|
||||
|
||||
|
||||
RHCE Exam: Manage System LogsUsing Rsyslogd and Logrotate – Part 5
|
||||
|
||||
In RHEL 7, the [rsyslogd][1] daemon is responsible for system logging and reads its configuration from /etc/rsyslog.conf (this file specifies the default location for all system logs) and from files inside /etc/rsyslog.d, if any.
|
||||
|
||||
### Rsyslogd Configuration ###
|
||||
|
||||
A quick inspection of the [rsyslog.conf][2] will be helpful to start. This file is divided into 3 main sections: Modules (since rsyslog follows a modular design), Global directives (used to set global properties of the rsyslogd daemon), and Rules. As you will probably guess, this last section indicates what gets logged or shown (also known as the selector) and where, and will be our focus throughout this article.
|
||||
|
||||
A typical line in rsyslog.conf is as follows:
|
||||
|
||||
|
||||
|
||||
Rsyslogd Configuration
|
||||
|
||||
In the image above, we can see that a selector consists of one or more pairs Facility:Priority separated by semicolons, where Facility describes the type of message (refer to [section 4.1.1 in RFC 3164][3] to see the complete list of facilities available for rsyslog) and Priority indicates its severity, which can be one of the following self-explanatory words:
|
||||
|
||||
- debug
|
||||
- info
|
||||
- notice
|
||||
- warning
|
||||
- err
|
||||
- crit
|
||||
- alert
|
||||
- emerg
|
||||
|
||||
Though not a priority itself, the keyword none means no priority at all of the given facility.
|
||||
|
||||
**Note**: That a given priority indicates that all messages of such priority and above should be logged. Thus, the line in the example above instructs the rsyslogd daemon to log all messages of priority info or higher (regardless of the facility) except those belonging to mail, authpriv, and cron services (no messages coming from this facilities will be taken into account) to /var/log/messages.
|
||||
|
||||
You can also group multiple facilities using the colon sign to apply the same priority to all of them. Thus, the line:
|
||||
|
||||
*.info;mail.none;authpriv.none;cron.none /var/log/messages
|
||||
|
||||
Could be rewritten as
|
||||
|
||||
*.info;mail,authpriv,cron.none /var/log/messages
|
||||
|
||||
In other words, the facilities mail, authpriv, and cron are grouped and the keyword none is applied to the three of them.
|
||||
|
||||
#### Creating a custom log file ####
|
||||
|
||||
To log all daemon messages to /var/log/tecmint.log, we need to add the following line either in rsyslog.conf or in a separate file (easier to manage) inside /etc/rsyslog.d:
|
||||
|
||||
daemon.* /var/log/tecmint.log
|
||||
|
||||
Let’s restart the daemon (note that the service name does not end with a d):
|
||||
|
||||
# systemctl restart rsyslog
|
||||
|
||||
And check the contents of our custom log before and after restarting two random daemons:
|
||||
|
||||
|
||||
|
||||
Create Custom Log File
|
||||
|
||||
As a self-study exercise, I would recommend you play around with the facilities and priorities and either log additional messages to existing log files or create new ones as in the previous example.
|
||||
|
||||
### Rotating Logs using Logrotate ###
|
||||
|
||||
To prevent log files from growing endlessly, the logrotate utility is used to rotate, compress, remove, and alternatively mail logs, thus easing the administration of systems that generate large numbers of log files.
|
||||
|
||||
Logrotate runs daily as a cron job (/etc/cron.daily/logrotate) and reads its configuration from /etc/logrotate.conf and from files located in /etc/logrotate.d, if any.
|
||||
|
||||
As with the case of rsyslog, even when you can include settings for specific services in the main file, creating separate configuration files for each one will help organize your settings better.
|
||||
|
||||
Let’s take a look at a typical logrotate.conf:
|
||||
|
||||
|
||||
|
||||
Logrotate Configuration
|
||||
|
||||
In the example above, logrotate will perform the following actions for /var/loh/wtmp: attempt to rotate only once a month, but only if the file is at least 1 MB in size, then create a brand new log file with permissions set to 0664 and ownership given to user root and group utmp. Next, only keep one archived log, as specified by the rotate directive:
|
||||
|
||||
|
||||
|
||||
Logrotate Logs Monthly
|
||||
|
||||
Let’s now consider another example as found in /etc/logrotate.d/httpd:
|
||||
|
||||
|
||||
|
||||
Rotate Apache Log Files
|
||||
|
||||
You can read more about the settings for logrotate in its man pages ([man logrotate][4] and [man logrotate.conf][5]). Both files are provided along with this article in PDF format for your reading convenience.
|
||||
|
||||
As a system engineer, it will be pretty much up to you to decide for how long logs will be stored and in what format, depending on whether you have /var in a separate partition / logical volume. Otherwise, you really want to consider removing old logs to save storage space. On the other hand, you may be forced to keep several logs for future security auditing according to your company’s or client’s internal policies.
|
||||
|
||||
#### Saving Logs to a Database ####
|
||||
|
||||
Of course examining logs (even with the help of tools such as grep and regular expressions) can become a rather tedious task. For that reason, rsyslog allows us to export them into a database (OTB supported RDBMS include MySQL, MariaDB, PostgreSQL, and Oracle.
|
||||
|
||||
This section of the tutorial assumes that you have already installed the MariaDB server and client in the same RHEL 7 box where the logs are being managed:
|
||||
|
||||
# yum update && yum install mariadb mariadb-server mariadb-client rsyslog-mysql
|
||||
# systemctl enable mariadb && systemctl start mariadb
|
||||
|
||||
Then use the `mysql_secure_installation` utility to set the password for the root user and other security considerations:
|
||||
|
||||
|
||||
|
||||
Secure MySQL Database
|
||||
|
||||
Note: If you don’t want to use the MariaDB root user to insert log messages to the database, you can configure another user account to do so. Explaining how to do that is out of the scope of this tutorial but is explained in detail in [MariaDB knowledge][6] base. In this tutorial we will use the root account for simplicity.
|
||||
|
||||
Next, download the createDB.sql script from [GitHub][7] and import it into your database server:
|
||||
|
||||
# mysql -u root -p < createDB.sql
|
||||
|
||||
|
||||
|
||||
Save Server Logs to Database
|
||||
|
||||
Finally, add the following lines to /etc/rsyslog.conf:
|
||||
|
||||
$ModLoad ommysql
|
||||
$ActionOmmysqlServerPort 3306
|
||||
*.* :ommysql:localhost,Syslog,root,YourPasswordHere
|
||||
|
||||
Restart rsyslog and the database server:
|
||||
|
||||
# systemctl restart rsyslog
|
||||
# systemctl restart mariadb
|
||||
|
||||
#### Querying the Logs using SQL syntax ####
|
||||
|
||||
Now perform some tasks that will modify the logs (like stopping and starting services, for example), then log to your DB server and use standard SQL commands to display and search in the logs:
|
||||
|
||||
USE Syslog;
|
||||
SELECT ReceivedAt, Message FROM SystemEvents;
|
||||
|
||||
|
||||
|
||||
Query Logs in Database
|
||||
|
||||
### Summary ###
|
||||
|
||||
In this article we have explained how to set up system logging, how to rotate logs, and how to redirect the messages to a database for easier search. We hope that these skills will be helpful as you prepare for the [RHCE exam][8] and in your daily responsibilities as well.
|
||||
|
||||
As always, your feedback is more than welcome. Feel free to use the form below to reach us.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.tecmint.com/manage-linux-system-logs-using-rsyslogd-and-logrotate/
|
||||
|
||||
作者：[Gabriel Cánepa][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.tecmint.com/author/gacanepa/
|
||||
[1]:http://www.tecmint.com/wp-content/pdf/rsyslogd.pdf
|
||||
[2]:http://www.tecmint.com/wp-content/pdf/rsyslog.conf.pdf
|
||||
[3]:https://tools.ietf.org/html/rfc3164#section-4.1.1
|
||||
[4]:http://www.tecmint.com/wp-content/pdf/logrotate.pdf
|
||||
[5]:http://www.tecmint.com/wp-content/pdf/logrotate.conf.pdf
|
||||
[6]:https://mariadb.com/kb/en/mariadb/create-user/
|
||||
[7]:https://github.com/sematext/rsyslog/blob/master/plugins/ommysql/createDB.sql
|
||||
[8]:http://www.tecmint.com/how-to-setup-and-configure-static-network-routing-in-rhel/
|
||||
@ -0,0 +1,169 @@
|
||||
第五部分 - 如何在 RHEL 7 中管理系统日志（配置、旋转以及导入到数据库）
|
||||
================================================================================
|
||||
为了确保你的 RHEL 7 系统安全，你需要通过查看日志文件监控系统中发生的所有活动。这样，你就可以检测任何不正常或有潜在破坏的活动并进行系统故障排除或者其它恰当的操作。
|
||||
|
||||
|
||||
|
||||
（译者注：[日志旋转][9]是系统管理中归档每天产生的日志文件的自动化过程）
|
||||
|
||||
RHCE 考试 - 第五部分：使用 Rsyslog 和 Logrotate 管理系统日志
|
||||
|
||||
在 RHEL 7 中，[rsyslogd][1] 守护进程负责系统日志，它从 /etc/rsyslog.conf（该文件指定所有系统日志的默认路径）和 /etc/rsyslog.d 中的所有文件（如果有的话）读取配置信息。
|
||||
|
||||
### Rsyslogd 配置 ###
|
||||
|
||||
快速浏览一下 [rsyslog.conf][2] 会是一个好的开端。该文件分为 3 个主要部分：模块（rsyslong 按照模块化设计），全局指令（用于设置 rsyslogd 守护进程的全局属性），以及规则。正如你可能猜想的，最后一个部分指示获取，显示以及在哪里保存什么的日志（也称为选择子），这也是这篇博文关注的重点。
|
||||
|
||||
rsyslog.conf 中典型的一行如下所示：
|
||||
|
||||
|
||||
|
||||
Rsyslogd 配置
|
||||
|
||||
在上面的图片中，我们可以看到一个选择子包括了一个或多个用分号分隔的设备：优先级（Facility:Priority）对，其中设备描述了消息类型（参考 [RFC 3164 4.1.1 章节][3] 查看 rsyslog 可用的完整设备列表），优先级指示它的严重性，这可能是以下几种之一：
|
||||
|
||||
- debug
|
||||
- info
|
||||
- notice
|
||||
- warning
|
||||
- err
|
||||
- crit
|
||||
- alert
|
||||
- emerg
|
||||
|
||||
尽管自身并不是一个优先级，关键字 none 意味着指定设备没有任何优先级。
|
||||
|
||||
**注意**：给定一个优先级表示该优先级以及之上的消息都应该记录到日志中。因此，上面例子中的行指示 rsyslogd 守护进程记录所有优先级为 info 以及以上（不管是什么设备）的除了属于 mail、authpriv、以及 cron 服务（不考虑来自这些设备的消息）的消息到 /var/log/messages。
|
||||
|
||||
你也可以使用逗号将多个设备分为一组，对同组中的设备使用相同的优先级。例如下面这行：
|
||||
|
||||
*.info;mail.none;authpriv.none;cron.none /var/log/messages
|
||||
|
||||
也可以这样写：
|
||||
|
||||
*.info;mail,authpriv,cron.none /var/log/messages
|
||||
|
||||
换句话说，mail、authpriv 以及 cron 被分为一组，并使用关键字 none。
|
||||
|
||||
#### 创建自定义日志文件 ####
|
||||
|
||||
要把所有的守护进程消息记录到 /var/log/tecmint.log，我们需要在 rsyslog.conf 或者 /etc/rsyslog.d 目录中的单独文件（易于管理）添加下面一行：
|
||||
|
||||
daemon.* /var/log/tecmint.log
|
||||
|
||||
然后重启守护进程（注意服务名称不以 d 结尾）：
|
||||
|
||||
# systemctl restart rsyslog
|
||||
|
||||
在随机重启两个守护进程之前和之后查看自定义日志的内容：
|
||||
|
||||
|
||||
|
||||
创建自定义日志文件
|
||||
|
||||
作为一个自学练习，我建议你重点关注设备和优先级，添加额外的消息到已有的日志文件或者像上面那样创建一个新的日志文件。
|
||||
|
||||
### 使用 Logrotate 旋转日志 ###
|
||||
|
||||
为了防止日志文件无限制增长，logrotate 工具用于旋转、压缩、移除或者通过电子邮件发送日志，从而减轻管理会产生大量日志文件系统的困难。
|
||||
|
||||
Logrotate 作为一个 cron 作业（/etc/cron.daily/logrotate）每天运行，并从 /etc/logrotate.conf 和 /etc/logrotate.d 中的文件（如果有的话）读取配置信息。
|
||||
|
||||
对于 rsyslog，即使你可以在主文件中为指定服务包含设置，为每个服务创建单独的配置文件能帮助你更好地组织设置。
|
||||
|
||||
让我们来看一个典型的 logrotate.conf：
|
||||
|
||||
|
||||
|
||||
Logrotate 配置
|
||||
|
||||
在上面的例子中，logrotate 会为 /var/log/wtmp 进行以下操作：尝试每个月旋转一次，但至少文件要大于 1MB，然后用 0664 权限、用户 root、组 utmp 创建一个新的日志文件。下一步只保存一个归档日志，正如旋转指令指定的：
|
||||
|
||||
|
||||
|
||||
每月 Logrotate 日志
|
||||
|
||||
让我们再来看看 /etc/logrotate.d/httpd 中的另一个例子：
|
||||
|
||||
|
||||
|
||||
旋转 Apache 日志文件
|
||||
|
||||
你可以在 logrotate 的 man 手册（[man logrotate][4] 和 [man logrotate.conf][5]）中阅读更多有关它的设置。为了方便你的阅读，本文还提供了两篇文章的 PDF 格式。
|
||||
|
||||
作为一个系统工程师，很可能由你决定多久按照什么格式保存一次日志，取决于你是否有一个单独的分区/逻辑卷给 /var。否则，你真的要考虑删除旧日志以节省存储空间。另一方面，根据你公司和客户内部的政策，为了以后的安全审核，你可能被迫要保留多个日志。
|
||||
|
||||
#### 保存日志到数据库 ####
|
||||
|
||||
当然检查日志可能是一个很繁琐的工作（即使有类似 grep 工具和正则表达式的帮助）。因为这个原因，rsyslog 允许我们把它们导出到数据库（OTB 支持的关系数据库管理系统包括 MySQL、MariaDB、PostgreSQL 和 Oracle）。
|
||||
|
||||
指南的这部分假设你已经在要管理日志的 RHEL 7 上安装了 MariaDB 服务器和客户端：
|
||||
|
||||
# yum update && yum install mariadb mariadb-server mariadb-client rsyslog-mysql
|
||||
# systemctl enable mariadb && systemctl start mariadb
|
||||
|
||||
然后使用 `mysql_secure_installation` 工具为 root 用户设置密码以及其它安全考量：
|
||||
|
||||
|
||||
|
||||
|
||||
保证 MySQL 数据库安全
|
||||
|
||||
注意：如果你不想用 MariaDB root 用户插入日志消息到数据库，你也可以配置用另一个用户账户。如何实现的介绍已经超出了本文的范围，但在 [MariaDB 知识][6] 中有详细解析。为了简单在这篇指南中我们会使用 root 账户。
|
||||
|
||||
下一步，从 [GitHub][7] 下载 createDB.sql 脚本并导入到你的数据库服务器：
|
||||
|
||||
# mysql -u root -p < createDB.sql
|
||||
|
||||
|
||||
|
||||
保存服务器日志到数据库
|
||||
|
||||
最后，添加下面的行到 /etc/rsyslog.conf：
|
||||
|
||||
$ModLoad ommysql
|
||||
$ActionOmmysqlServerPort 3306
|
||||
*.* :ommysql:localhost,Syslog,root,YourPasswordHere
|
||||
|
||||
重启 rsyslog 和数据库服务器：
|
||||
|
||||
# systemctl restart rsyslog
|
||||
# systemctl restart mariadb
|
||||
|
||||
#### 使用 SQL 语法查询日志 ####
|
||||
|
||||
现在执行一些会改变日志的操作（例如停止和启动服务），然后登陆到你的 DB 服务器并使用标准的 SQL 命令显示和查询日志：
|
||||
|
||||
USE Syslog;
|
||||
SELECT ReceivedAt, Message FROM SystemEvents;
|
||||
|
||||
|
||||
|
||||
在数据库中查询日志
|
||||
|
||||
### 总结 ###
|
||||
|
||||
在这篇文章中我们介绍了如何设置系统日志，如果旋转日志以及为了简化查询如何重定向消息到数据库。我们希望这些技巧能对你准备 [RHCE 考试][8] 和日常工作有所帮助。
|
||||
|
||||
正如往常，非常欢迎你的反馈。用下面的表单和我们联系吧。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: http://www.tecmint.com/manage-linux-system-logs-using-rsyslogd-and-logrotate/
|
||||
|
||||
作者：[Gabriel Cánepa][a]
|
||||
译者：[ictlyh](http://www.mutouxiaogui.cn/blog/)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:http://www.tecmint.com/author/gacanepa/
|
||||
[1]:http://www.tecmint.com/wp-content/pdf/rsyslogd.pdf
|
||||
[2]:http://www.tecmint.com/wp-content/pdf/rsyslog.conf.pdf
|
||||
[3]:https://tools.ietf.org/html/rfc3164#section-4.1.1
|
||||
[4]:http://www.tecmint.com/wp-content/pdf/logrotate.pdf
|
||||
[5]:http://www.tecmint.com/wp-content/pdf/logrotate.conf.pdf
|
||||
[6]:https://mariadb.com/kb/en/mariadb/create-user/
|
||||
[7]:https://github.com/sematext/rsyslog/blob/master/plugins/ommysql/createDB.sql
|
||||
[8]:http://www.tecmint.com/how-to-setup-and-configure-static-network-routing-in-rhel/
|
||||
[9]:https://en.wikipedia.org/wiki/Log_rotation
|
||||
Loading…
Reference in New Issue
Block a user