Logging

Reading logs

• who (is logged in now)

• last (history of logins)

  • last <username>
  • last <reboot>
  • lastlog (logins)
  • last log (log files)

• ls /var/log

• sudo tail /var/log/syslog

  Copy
  Timestamp, Hostname, App-Name, Message

Tips

grep "invalid user" /var/log/auth.log

rsyslog

• ls /etc/rsyslog.d

• cat /etc/rsyslog.d/50-default.conf

  Copy
  facility.priority   logLocation
  cron.warn           /var/log/cron.warn 
  cron.=info          /var/log/cron.info
  cron.!=info         /var/log/cron.info

Tips

• Rules are applied in order. Use numbers in filename to order rules.
• Restart system service after changes.

Rsyslog Docs

logger

Tips

logger [options] [message]

• logger -p cron.info " This is a info message from cron" (-p means priority)

Quiz

1. Enable cron logging for all levels to go to your user console
   • create a cron error and verify it works
2. Change cron logging for all levels to go to /var/log/cron.log
3. Create a rule for local4 critical level logs to be sent to /var/log/local4-info.log
4. Use logger to send a message from local4 of critical level to the log

logrotate

Tips

• cat /etc/logrotate.conf
• logrotate -fv /etc/logrotate.conf
  • -f, --force
  • +-v, --verbose

Quiz

1. Enable compression on your log files
2. Create a logrotate group and allow it to use the logrotate command
3. Rotate your lightdm logs