CST 8177 Linux II Services logging accounting Todd
![CST 8177 – Linux II Services, logging, accounting Todd Kelley kelleyt@algonquincollege. com CST 8177– CST 8177 – Linux II Services, logging, accounting Todd Kelley kelleyt@algonquincollege. com CST 8177–](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-1.jpg)
![Topics services syslog logger command line utility psacct lastcomm ac, lastlog 2 Topics services syslog logger command line utility psacct lastcomm ac, lastlog 2](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-2.jpg)
![chkconfig vs service (review) The chkconfig command allows us to manage the runlevels in chkconfig vs service (review) The chkconfig command allows us to manage the runlevels in](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-3.jpg)
![Inside the script The command used in the general service command line (previous slide) Inside the script The command used in the general service command line (previous slide)](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-4.jpg)
![System Services: examples We've seen several system services by now NTP service: keeps clock System Services: examples We've seen several system services by now NTP service: keeps clock](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-5.jpg)
![System Services: examples SSH service: logins with Putty. exe or ssh ◦ ◦ ◦ System Services: examples SSH service: logins with Putty. exe or ssh ◦ ◦ ◦](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-6.jpg)
![System Services: daemons daemon: ◦ a program, launched at boot time usually /etc/init. d/* System Services: daemons daemon: ◦ a program, launched at boot time usually /etc/init. d/*](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-7.jpg)
![System Services: config files System Service Daemons have config files Normally maintained somewhere in System Services: config files System Service Daemons have config files Normally maintained somewhere in](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-8.jpg)
![config files (cont'd) Often config files have many comments in them # is a config files (cont'd) Often config files have many comments in them # is a](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-9.jpg)
![config files (cont'd) From /etc/sshd_config # Logging # obsoletes Quiet. Mode and Fascist. Logging config files (cont'd) From /etc/sshd_config # Logging # obsoletes Quiet. Mode and Fascist. Logging](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-10.jpg)
![config files (cont'd) To comment out this line Syslog. Facility AUTH it becomes #Syslog. config files (cont'd) To comment out this line Syslog. Facility AUTH it becomes #Syslog.](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-11.jpg)
![System Services: clients So far in your work with computers you've seen more of System Services: clients So far in your work with computers you've seen more of](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-12.jpg)
![System Services: logging Daemons need a place where they can send their output Most System Services: logging Daemons need a place where they can send their output Most](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-13.jpg)
![Syslog config: /etc/rsyslog. conf /etc/rsyslog. conf contains a set of rules When a log Syslog config: /etc/rsyslog. conf /etc/rsyslog. conf contains a set of rules When a log](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-14.jpg)
![Logging Rules Each rule takes a single line, with a selector on the left Logging Rules Each rule takes a single line, with a selector on the left](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-15.jpg)
![Syslog Facilities ◦ ◦ ◦ ◦ auth : authorization authpriv : private authorization cron Syslog Facilities ◦ ◦ ◦ ◦ auth : authorization authpriv : private authorization cron](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-16.jpg)
![Syslog Priorities • The priorities are the level of importance of the message, and Syslog Priorities • The priorities are the level of importance of the message, and](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-17.jpg)
![Syslog Priorities In order of increasing priority: ◦ ◦ ◦ ◦ ◦ debug : Syslog Priorities In order of increasing priority: ◦ ◦ ◦ ◦ ◦ debug :](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-18.jpg)
![Actions The action part of a logging rule specifies what to do when rsyslog Actions The action part of a logging rule specifies what to do when rsyslog](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-19.jpg)
![Syslog actions Absolute pathname of a file ◦ put the message (log entry) in Syslog actions Absolute pathname of a file ◦ put the message (log entry) in](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-20.jpg)
![More detail on Selectors A selector is a facility, a dot, and a priority More detail on Selectors A selector is a facility, a dot, and a priority](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-21.jpg)
![rsyslog. conf examples Here is the rule that says for all facilities except mail, rsyslog. conf examples Here is the rule that says for all facilities except mail,](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-22.jpg)
![logger command logger: the command line utility for putting an entry in the logs logger command logger: the command line utility for putting an entry in the logs](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-23.jpg)
![logwatch With all this logging information being recorded, a sysadmin should be monitoring it logwatch With all this logging information being recorded, a sysadmin should be monitoring it](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-24.jpg)
![Daily sysadmin tasks (cron revisited) /etc/crontab is the main system crontab On Cent. OS Daily sysadmin tasks (cron revisited) /etc/crontab is the main system crontab On Cent. OS](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-25.jpg)
![logwatch On our Cent. OS 6. 5 minimal systems, logwatch is not installed by logwatch On our Cent. OS 6. 5 minimal systems, logwatch is not installed by](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-26.jpg)
![logwatch. conf Examples: Mail. To = root Detail = Low # email sent to logwatch. conf Examples: Mail. To = root Detail = Low # email sent to](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-27.jpg)
![logrotate log files grow under normal use of the system eventually they would fill logrotate log files grow under normal use of the system eventually they would fill](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-28.jpg)
![logrotate. conf how often should log files be rotated how big should log files logrotate. conf how often should log files be rotated how big should log files](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-29.jpg)
![logrotate. conf daily, weekly, or monthly rotations rotate 5 : keep 5 backlog files logrotate. conf daily, weekly, or monthly rotations rotate 5 : keep 5 backlog files](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-30.jpg)
![Services/Logging overview Services are provided by programs running in the background, with no terminal Services/Logging overview Services are provided by programs running in the background, with no terminal](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-31.jpg)
![Services/Logging overview Their behavior is controlled by a config file, where the admin specifies Services/Logging overview Their behavior is controlled by a config file, where the admin specifies](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-32.jpg)
![Examples SSH ◦ configure port ◦ configure logging HTTP ◦ ◦ ◦ install it Examples SSH ◦ configure port ◦ configure logging HTTP ◦ ◦ ◦ install it](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-33.jpg)
![Process Accounting Process accounting is concerned with keeping track of commands executed and resources Process Accounting Process accounting is concerned with keeping track of commands executed and resources](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-34.jpg)
![psacct psacct is the process accounting service not installed by default on Cent. OS psacct psacct is the process accounting service not installed by default on Cent. OS](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-35.jpg)
![ac, lastlog, faillog ac: print statistics about users' connect time man ac $ ac ac, lastlog, faillog ac: print statistics about users' connect time man ac $ ac](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-36.jpg)
![last last: listing of last logged in users last –t YYYYMMDDHHMMSS who was logged last last: listing of last logged in users last –t YYYYMMDDHHMMSS who was logged](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-37.jpg)
![lastlog : reports the most recent login of all users or of a given lastlog : reports the most recent login of all users or of a given](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-38.jpg)
![lastcomm with psacct enabled, we can view info on previously executed commands lastcomm --user lastcomm with psacct enabled, we can view info on previously executed commands lastcomm --user](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-39.jpg)
![sa sa : summarize accounting information man sa for more detail Fields: ◦ ◦ sa sa : summarize accounting information man sa for more detail Fields: ◦ ◦](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-40.jpg)
- Slides: 40
![CST 8177 Linux II Services logging accounting Todd Kelley kelleytalgonquincollege com CST 8177 CST 8177 – Linux II Services, logging, accounting Todd Kelley kelleyt@algonquincollege. com CST 8177–](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-1.jpg)
CST 8177 – Linux II Services, logging, accounting Todd Kelley kelleyt@algonquincollege. com CST 8177– Todd Kelley 1
![Topics services syslog logger command line utility psacct lastcomm ac lastlog 2 Topics services syslog logger command line utility psacct lastcomm ac, lastlog 2](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-2.jpg)
Topics services syslog logger command line utility psacct lastcomm ac, lastlog 2
![chkconfig vs service review The chkconfig command allows us to manage the runlevels in chkconfig vs service (review) The chkconfig command allows us to manage the runlevels in](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-3.jpg)
chkconfig vs service (review) The chkconfig command allows us to manage the runlevels in which the services are started. It does not do anything to any running process, the daemons that actually provide the services. To manage the service daemons themselves (as root, naturally), we use the service command. service daemon command optional-options It's done by running the script in /etc/rc. d/init. d with the matching name. For example, say you wanted to stop the crond daemon to end the cron service. The command is service crond stop What actually runs is this: /etc/rc. d/init. d/crond stop
![Inside the script The command used in the general service command line previous slide Inside the script The command used in the general service command line (previous slide)](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-4.jpg)
Inside the script The command used in the general service command line (previous slide) is passed directly into the script for crond. Here's a snippet from inside the crond script ($1 means the first argument): case "$1" in start). . . stop). . . restart). . . reload). . . status). . . *) echo $"Usage: . . . exit 2 esac
![System Services examples Weve seen several system services by now NTP service keeps clock System Services: examples We've seen several system services by now NTP service: keeps clock](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-5.jpg)
System Services: examples We've seen several system services by now NTP service: keeps clock accurate ◦ ◦ ◦ ntpd : the daemon /etc/ntp. conf : the daemon config file /etc/init. d/ntpd : the Sys. Vinit script ntpd daemon itself IS the client (of an ntp server) ntpd logs to /var/log/messages CST 8177 – Todd Kelley 5
![System Services examples SSH service logins with Putty exe or ssh System Services: examples SSH service: logins with Putty. exe or ssh ◦ ◦ ◦](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-6.jpg)
System Services: examples SSH service: logins with Putty. exe or ssh ◦ ◦ ◦ ◦ ◦ sshd : the daemon (SSH server) /etc/sshd_config : the daemon config file /etc/init. d/sshd : the Sys. Vinit script client program: putty. exe, ssh, scp, and more daemon logs its messages to /var/log/secure client manpage: man ssh daemon manpage: man sshd daemon config file manpage: man 5 sshd_config client config file manpage: man 5 ssh_config If we stop the sshd daemon, noone can log in over SSH CST 8177 – Todd Kelley 6
![System Services daemons daemon a program launched at boot time usually etcinit d System Services: daemons daemon: ◦ a program, launched at boot time usually /etc/init. d/*](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-7.jpg)
System Services: daemons daemon: ◦ a program, launched at boot time usually /etc/init. d/* : the Sys. Vinit scripts for starting, stopping, restarting, getting status of daemons ◦ doesn't terminate – it keeps providing the service ◦ many daemons, but not all, take requests from a corresponding client program ◦ examples: sshd : secure shell daemon, serves the ssh client httpd : web server daemon, serves web browser client crond : cron daemon, no client ntpd: a client that provides a system service and uses an ntp server CST 8177 – Todd Kelley 7
![System Services config files System Service Daemons have config files Normally maintained somewhere in System Services: config files System Service Daemons have config files Normally maintained somewhere in](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-8.jpg)
System Services: config files System Service Daemons have config files Normally maintained somewhere in /etc/ Often end in ". conf" Default config file comes with install package System administrators customize them Config files control various parameters ◦ some parameters apply to many services: how should logging be done what port should the service listen on ◦ some are specific to an individual service: ntpd: which ntp server should be used sshd: which version(s) of SSH protocol to use CST 8177 – Todd Kelley 8
![config files contd Often config files have many comments in them is a config files (cont'd) Often config files have many comments in them # is a](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-9.jpg)
config files (cont'd) Often config files have many comments in them # is a common comment character ◦ usually lines beginning with # are ignored Various possible options will be "commented out" Those options can be activated by "uncommenting" them CST 8177 – Todd Kelley 9
![config files contd From etcsshdconfig Logging obsoletes Quiet Mode and Fascist Logging config files (cont'd) From /etc/sshd_config # Logging # obsoletes Quiet. Mode and Fascist. Logging](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-10.jpg)
config files (cont'd) From /etc/sshd_config # Logging # obsoletes Quiet. Mode and Fascist. Logging Syslog. Facility AUTH #Syslog. Facility AUTHPRIV #Log. Level INFO # Authentication: #Login. Grace. Time 2 m #Permit. Root. Login yes #Strict. Modes yes #Max. Auth. Tries 6 CST 8177 – Todd Kelley 10
![config files contd To comment out this line Syslog Facility AUTH it becomes Syslog config files (cont'd) To comment out this line Syslog. Facility AUTH it becomes #Syslog.](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-11.jpg)
config files (cont'd) To comment out this line Syslog. Facility AUTH it becomes #Syslog. Facility AUTH and to uncomment this line #Syslog. Facility AUTHPRIV it becomes Syslog. Facility AUTHPRIV CST 8177 – Todd Kelley 11
![System Services clients So far in your work with computers youve seen more of System Services: clients So far in your work with computers you've seen more of](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-12.jpg)
System Services: clients So far in your work with computers you've seen more of the clients than the servers. Examples of clients you use all the time ◦ ◦ ◦ ssh, putty. exe Web Browser Explorer (Windows Networking) ftp DHCP (example: network connection at Algonquin) Each of these clients requires a server to be running at the "other end" CST 8177 – Todd Kelley 12
![System Services logging Daemons need a place where they can send their output Most System Services: logging Daemons need a place where they can send their output Most](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-13.jpg)
System Services: logging Daemons need a place where they can send their output Most daemons use the rsyslog (syslog for short) logging service Centralized logs are easier to manage rsyslog is itself a daemon ◦ daemon : rsyslogd ◦ config file : rsyslog. conf ◦ client program: logger command line utility, as well as all the other daemons send their messages to syslog, and syslog puts those messages in an appropriate place, usually a file under /var/log/ CST 8177 – Todd Kelley 13
![Syslog config etcrsyslog conf etcrsyslog conf contains a set of rules When a log Syslog config: /etc/rsyslog. conf /etc/rsyslog. conf contains a set of rules When a log](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-14.jpg)
Syslog config: /etc/rsyslog. conf /etc/rsyslog. conf contains a set of rules When a log message is sent from a daemon to syslog, the message is marked with a facility and a priority The facility is an indictor of what kind of message it is The priority is an indicator of how urgent the message is /etc/rsyslog. conf determines what actions are taken for different priorities of the messages of different facilities CST 8177 – Todd Kelley 14
![Logging Rules Each rule takes a single line with a selector on the left Logging Rules Each rule takes a single line, with a selector on the left](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-15.jpg)
Logging Rules Each rule takes a single line, with a selector on the left and an action on the right, separated by white space (blanks and tabs). The selector is in two parts, the facility and the priority, joined by a dot. selector action facility. priority action There a whole host of possible actions, from the typical one of "put the message into this log file" to "tell everyone logged-in at once!!!" and lots in-between including email.
![Syslog Facilities auth authorization authpriv private authorization cron Syslog Facilities ◦ ◦ ◦ ◦ auth : authorization authpriv : private authorization cron](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-16.jpg)
Syslog Facilities ◦ ◦ ◦ ◦ auth : authorization authpriv : private authorization cron : crond daemon : other misc daemons kern : the kernel lpr : printer mail : email news : usenet news syslog : syslog itself user : user messages uucp : unix to unix copy local 0 through local 7 : local use * : all of the above CST 8177 – Todd Kelley 16
![Syslog Priorities The priorities are the level of importance of the message and Syslog Priorities • The priorities are the level of importance of the message, and](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-17.jpg)
Syslog Priorities • The priorities are the level of importance of the message, and are fixed. They are listed here in ascending order, so debug has the lowest priority and emerg the highest. This is important, since messages are sent to a range of priorities. • Messages are logged according to the rules for the specified priority and all lower priorities (higher in the list). A crit error (for example) is also logged according to any rules for err, warning, notice, info, and debug.
![Syslog Priorities In order of increasing priority debug Syslog Priorities In order of increasing priority: ◦ ◦ ◦ ◦ ◦ debug :](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-18.jpg)
Syslog Priorities In order of increasing priority: ◦ ◦ ◦ ◦ ◦ debug : debug level messages info : normal information notice : normal but significant, unusual warning : not an error, but action should be taken err : error condition, non-urgent failure crit : critical condition, failure in primary system alert : action needed immediately emerg : panic, system unusable, notify all * : all of the above none: none of the above for the given facility CST 8177 – Todd Kelley 18
![Actions The action part of a logging rule specifies what to do when rsyslog Actions The action part of a logging rule specifies what to do when rsyslog](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-19.jpg)
Actions The action part of a logging rule specifies what to do when rsyslog receives a message of that priority for that facility A common action is to put the message in a file, and this action would be specified as an absolute pathname to a file CST 8177 – Todd Kelley 19
![Syslog actions Absolute pathname of a file put the message log entry in Syslog actions Absolute pathname of a file ◦ put the message (log entry) in](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-20.jpg)
Syslog actions Absolute pathname of a file ◦ put the message (log entry) in that file ◦ dash in front means omit syncing on every entry Terminal or Console : ex /dev/console ◦ write the message on that screen @hostname : remote machine ◦ send the message to syslog on the remote machine username ◦ write the message on that user's terminal * : everyone logged in ◦ write the message on everyone's screen named pipe (fifo) : useful for debugging CST 8177 – Todd Kelley 20
![More detail on Selectors A selector is a facility a dot and a priority More detail on Selectors A selector is a facility, a dot, and a priority](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-21.jpg)
More detail on Selectors A selector is a facility, a dot, and a priority level. A simple selector might be mail. info to log mail issues at info and debug priorities to whatever action is defined. Selectors can be combined in certain ways. For example, news, mail. info logs both news and mail issues. *. emerg will handle all facilities emerg priority messages the same way. And news. warning; mail. err will use the same action for each as if it were a separate selector. , combine facilities *. all facilities. * all priorities ; combine selectors. none no priority =priority only this priority !priority not this priority, only higher
![rsyslog conf examples Here is the rule that says for all facilities except mail rsyslog. conf examples Here is the rule that says for all facilities except mail,](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-22.jpg)
rsyslog. conf examples Here is the rule that says for all facilities except mail, authpriv, and cron, log messages of priority info and higher to /var/log/messages # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *. info; mail. none; authpriv. none; cron. none /var/log/messages Here is the rule that says for all facilities, if the priority is emerg, write the message on all screens of logged-in users (the * action) (the above rule will also apply) # Everybody gets emergency messages *. emerg * authpriv messages of all priorities go into /var/log/secure # The authpriv file has restricted access. authpriv. * /var/log/secure CST 8177 – Todd Kelley 22
![logger command logger the command line utility for putting an entry in the logs logger command logger: the command line utility for putting an entry in the logs](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-23.jpg)
logger command logger: the command line utility for putting an entry in the logs can be used to log the activity of scripts logger [-is] [-f file] [-p pri] [-t tag] [message. . . ] Examples: logger –p user. info –t logger "this is a test" logger –p authpriv. info –t kelleyt "another test" CST 8177 – Todd Kelley 23
![logwatch With all this logging information being recorded a sysadmin should be monitoring it logwatch With all this logging information being recorded, a sysadmin should be monitoring it](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-24.jpg)
logwatch With all this logging information being recorded, a sysadmin should be monitoring it You would think someone would have written a script to "grep" through logs, or summarize them Yes, they have! yum install logwatch is run daily: ◦ /etc/cron. daily/0 logwatch CST 8177 – Todd Kelley 24
![Daily sysadmin tasks cron revisited etccrontab is the main system crontab On Cent OS Daily sysadmin tasks (cron revisited) /etc/crontab is the main system crontab On Cent. OS](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-25.jpg)
Daily sysadmin tasks (cron revisited) /etc/crontab is the main system crontab On Cent. OS 6. 5, we can see it's configured to run hourly, daily, weekly, and monthly jobs To do a system admin task daily, for example, put a script that does the job into the /etc/cron. daily directory Similarly for hourly, weekly, monthly jobs /etc/crontab can be considered "root's" crontab file, but notice the "userid" field – the job will run as "userid" CST 8177 – Todd Kelley 25
![logwatch On our Cent OS 6 5 minimal systems logwatch is not installed by logwatch On our Cent. OS 6. 5 minimal systems, logwatch is not installed by](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-26.jpg)
logwatch On our Cent. OS 6. 5 minimal systems, logwatch is not installed by default After it's installed there is a link to a perl script in /etc/cron. daily By default, it emails a summary of the logs to root, with "low" detail We put custom configuration in /etc/logwatch/conf/logwatch. conf CST 8177 – Todd Kelley 26
![logwatch conf Examples Mail To root Detail Low email sent to logwatch. conf Examples: Mail. To = root Detail = Low # email sent to](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-27.jpg)
logwatch. conf Examples: Mail. To = root Detail = Low # email sent to root # low detail in the summary Detail can be specified as a number 0 to 10 Another example Mail. To = tgk 00001 Detail = High # email my sysadmin user # lots of detail CST 8177 – Todd Kelley 27
![logrotate log files grow under normal use of the system eventually they would fill logrotate log files grow under normal use of the system eventually they would fill](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-28.jpg)
logrotate log files grow under normal use of the system eventually they would fill the disks the logrotate facility manages the log files it will save a log file as a "backlog" file, and start a new empty version of that log file old backlogs can be deleted, or emailed logrotate is another process run daily through a shell script in /etc/cron. daily the logrotate process is configured by /etc/logrotate. conf CST 8177 – Todd Kelley 28
![logrotate conf how often should log files be rotated how big should log files logrotate. conf how often should log files be rotated how big should log files](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-29.jpg)
logrotate. conf how often should log files be rotated how big should log files get before they're rotated how many old backlog files should be kept what permissions should new empty log files get, and who should own those files CST 8177 – Todd Kelley 29
![logrotate conf daily weekly or monthly rotations rotate 5 keep 5 backlog files logrotate. conf daily, weekly, or monthly rotations rotate 5 : keep 5 backlog files](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-30.jpg)
logrotate. conf daily, weekly, or monthly rotations rotate 5 : keep 5 backlog files specific log files can have specific config /etc/logrotate. conf is configured to include individual package configurations from the directory /etc/logrotate. d/ Example: /etc/logrotate. d/yum /var/log/yum. log { yearly # this applies to } # over-riding yum only the setting in /etc/logrotate. conf CST 8177 – Todd Kelley 30
![ServicesLogging overview Services are provided by programs running in the background with no terminal Services/Logging overview Services are provided by programs running in the background, with no terminal](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-31.jpg)
Services/Logging overview Services are provided by programs running in the background, with no terminal No terminal means these programs are ◦ not designed to be controlled by a keyboard ◦ not designed to display output to a screen They are started/stopped/restarted by their init script in /etc/init. d/ ◦ at bootup or change-of-runlevel automatically, or ◦ manually with service command They send their "output" messages to the syslog service CST 8177 – Todd Kelley 31
![ServicesLogging overview Their behavior is controlled by a config file where the admin specifies Services/Logging overview Their behavior is controlled by a config file, where the admin specifies](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-32.jpg)
Services/Logging overview Their behavior is controlled by a config file, where the admin specifies settings They often provide the "server side" for a client: ◦ ftp client program running on a local computer connects to an ftp server program running on a remote computer ◦ ssh client program running on a local computer connects to an ssh server program running on a remote computer ◦ a web browser running on a local computer connects to a web server running on a remote computer CST 8177 – Todd Kelley 32
![Examples SSH configure port configure logging HTTP install it Examples SSH ◦ configure port ◦ configure logging HTTP ◦ ◦ ◦ install it](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-33.jpg)
Examples SSH ◦ configure port ◦ configure logging HTTP ◦ ◦ ◦ install it chkconfig it start it firewalling play with default document configuration file to change its behaviors CST 8177 – Todd Kelley 33
![Process Accounting Process accounting is concerned with keeping track of commands executed and resources Process Accounting Process accounting is concerned with keeping track of commands executed and resources](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-34.jpg)
Process Accounting Process accounting is concerned with keeping track of commands executed and resources used Linux kernel is capable of keeping process accounting records for the commands being run, the user who executed the command, the CPU time, and more. The process accounting service psacct is used to turn accounting on and off The psacct rpm includes accounting commands sa, ac, lastcomm CST 8177 – Todd Kelley 34
![psacct psacct is the process accounting service not installed by default on Cent OS psacct psacct is the process accounting service not installed by default on Cent. OS](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-35.jpg)
psacct psacct is the process accounting service not installed by default on Cent. OS 6. 5 When the psacct service is started, the kernel begins keeping track of resource usage various commands in the package make use of that resource usage info: ac, sc, lastcomm install and enable it with yum install psacct chkconfig psacct on # default runlevels 2, 3, 4, 5 service psacct start CST 8177 – Todd Kelley 35
![ac lastlog faillog ac print statistics about users connect time man ac ac ac, lastlog, faillog ac: print statistics about users' connect time man ac $ ac](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-36.jpg)
ac, lastlog, faillog ac: print statistics about users' connect time man ac $ ac –p –d p: individual totals d: daily totals CST 8177 – Todd Kelley 36
![last last listing of last logged in users last t YYYYMMDDHHMMSS who was logged last last: listing of last logged in users last –t YYYYMMDDHHMMSS who was logged](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-37.jpg)
last last: listing of last logged in users last –t YYYYMMDDHHMMSS who was logged in at that time CST 8177 – Todd Kelley 37
![lastlog reports the most recent login of all users or of a given lastlog : reports the most recent login of all users or of a given](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-38.jpg)
lastlog : reports the most recent login of all users or of a given user lastlog -u LOGIN for username LOGIN lastlog -b DAYS before DAYS ago lastlog -t DAYS since DAYS ago CST 8177 – Todd Kelley 38
![lastcomm with psacct enabled we can view info on previously executed commands lastcomm user lastcomm with psacct enabled, we can view info on previously executed commands lastcomm --user](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-39.jpg)
lastcomm with psacct enabled, we can view info on previously executed commands lastcomm --user USERNAME lastcomm --command COMMAND CST 8177 – Todd Kelley 39
![sa sa summarize accounting information man sa for more detail Fields sa sa : summarize accounting information man sa for more detail Fields: ◦ ◦](https://slidetodoc.com/presentation_image_h/a43140b26d7819298d36c9f8c3a7ae50/image-40.jpg)
sa sa : summarize accounting information man sa for more detail Fields: ◦ ◦ ◦ cpu sum of system and user time in cpu seconds re "real time" in cpu seconds k cpu-time averaged core usage, in 1 k units k*sec cpu storage integral (kilo-core seconds) u user cpu time in cpu seconds s system time in cpu seconds CST 8177 – Todd Kelley 40
Linux cst
Cst linux
Cst linux
Cst linux
Linux
Linux kernel linux security module m1
Cs423
Core system services in linux
Alfresco
Cst stands for
Cst training program
Ansys cst
What is cst element
Displacement function of cst
Cst 1101
Cst themes
Refractive index in physical pharmaceutics
Ohio risk assessment
Cst software introduction
Cst 1101
Algonquin college computer science
Cst 450
Principles of cst
Cst 1101
Art 129 cst
Cst 310
Cst file
Cst 203
Openhole logging
Advantage and disadvantage of logging
Alter table add supplemental log data
Perl logging best practices
Wireline log
Electronic logging device definition
Data logger advantages
Electronic logging device definition
Monolog levels
Drill core logging
Custom auditing
Ssis protection level best practices
Logging industry in canada