Difference between revisions of "Logs (Linux)"
Tags: Mobile web edit, Mobile edit |
Tags: Mobile web edit, Mobile edit |
||
| Line 44: | Line 44: | ||
== See also == | == See also == | ||
* {{tail}} | * {{tail}} | ||
| − | * | + | * {{journalctl}} |
* <code>[[Linux Administration/System Services/System Logging/logger|logger]]</code> and <code>[[systemd-cat]]</code> | * <code>[[Linux Administration/System Services/System Logging/logger|logger]]</code> and <code>[[systemd-cat]]</code> | ||
* [[auditd]]: https://linux.die.net/man/8/auditd | * [[auditd]]: https://linux.die.net/man/8/auditd | ||
Revision as of 12:24, 3 March 2020
Linux logs are save usually in /var/log folder. Most linux distribution uses syslog, syslog-ng or rsyslog software for logging or sending them to remote servers. Analytics and visualisation software such a Elasticsearch and Kibana can be used for log inspection.
Usage by Distribution:
Standard logs:
- Debian/Ubuntu:
/var/log/syslog - RHEL/Fedora:
/var/log/message
SSH sessions logging:
- Debian/Ubuntu:
/var/log/auth.log - RHEL/Fedora:
/var/log/secure
Misc:
- SUSE:
/var/log/warn.log
/var/log/message – Where whole system logs or current activity logs are available. /var/log/auth.log – Authentication logs. /var/log/kern.log – Kernel logs. /var/log/cron.log – Crond logs (cron job). /var/log/maillog – Mail server logs. /var/log/boot.log – System boot log. /var/log/mysqld.log – MySQL database server log file. /var/log/secure – Authentication log. /var/log/utmp or /var/log/wtmp : Login records file. /var/log/yum.log: Yum log files.
Rsyslog
Rsyslogd supports queued operations to handle offline outputs. Official documentation: https://www.rsyslog.com/doc/v8-stable/configuration/index.html
Rsyslog Configuration
Default configuration files by Distribution:
- Debian:
/etc/rsyslog.confman rsyslog.conf: https://linux.die.net/man/5/rsyslog.conf - Ubuntu:
/etc/rsyslog.d/50-default.conf
Docker
docker logscommand show docker logs.
See also https://stackoverflow.com/questions/30969435/where-is-the-docker-daemon-log/30970134#30970134 for further information about docker logs.
See also
- Files:
tail,mtail,promtail,aws logs tail,ktail, stern, kubectl logs - systemd-journald:
journalctl,/etc/systemd/journald.conf,journalctl logs,journalctl --list-boots,journalctl --disk-usage,journalctl -u kubelet,journalctl -u prometheus,journalctl --help loggerandsystemd-cat- auditd: https://linux.die.net/man/8/auditd
- acct package
- AWS Cloudtrail
- Netflow for network logging
- Message Brokers for routing messages: NSQ, RabbitMQ, Apache Kafka, AWS Kinesis and NATS Messaging
- fluentd
- logstash and filebeat products from Elastic
- Logwatch
- Linux logging, Cisco IOS logging
Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Source: https://en.wikiversity.org/wiki/Linux/logging
Advertising:
