�o�����O�̮e���Q�s��ҩ������A���N�O�ԲӦӽT�ꪺ�����Ϊ̬O�ƥ��t�Ϊ��n�����C����O�n���ɩO�H²�檺���A�N�O�O���t�ά��ʰO�����X���ɮסA�Ҧp�G��ɡB��a�]�ӷ� IP �^�B��H�] login name �^�B���F����ʧ@�A�t�~�N�O�t�Φb����ɭ��F����˪��欰�ɡA�o�ͤF����˪��ƥ��A�n���D���O�A�ڭ̪� Linux �D���b�I�����U�A���۷��h�� daemons �b�u�@�ۡA����o�Ǥu�@�����{���`�O�|���@�ǰT����ܡA�o����ܪ��T���N�O���O���b�n���ɷ����աA�]�N�O���A�O���o�Ǩt�Ϊ����n�T���A�N�O�n���ɩҶi�檺�����u�@�����e�F�C���ѩ�o�ǰO�����u�@���e���t�Ϊ���T�ӸԲӤF�A�Y�Q���o�N�i��v�T��t�Ϊ��w���ʡA�]���A�q�`�o�ǵn���ɥu�� root �i�H�i�����\���I
����n�O���P�ѪR�n���ɩO�H�o�O�ѩ�O���ɦ��X�ӭ��n���\��G
- �ѨM�t�Ϊ����~�G�o�ӹ��t�κz���ӻ��O�ܭ��n����T�A�Ҧp�G�}�����L�{���������쪺�w��T����Ʒ|�O����O��������A�ѩ�o�ǰ�������T�i�H���ѧڭ��A�ѵw���T�A�ҥH�p�G�A���t�εo�Ͱ��D�ɡA�i�H�U�F dmesg �ݬݵw�骺�������S���o�Ϳ��~�O�I�t�~�A�p�G�t�θ귽�Q�ӺɡB�֤߬��ʵo�Ϳ��~�����ƥ�o�ͪ��ɭԡA�h�t�εn���ɥ�|�N���~���T���O���b�n���ɤ��]�q�`�O /var/log/messages �^�A�o�dz��i�H�ǥH���o���~�o�ͮɪ���T�A�å[�H�J�A���D�I�I
- �ѨM�����A�Ȫ����D�G�b�w�˩γ]�w�s�A�Ȫ��M��ɡA�̱`�ϥΨ�o�ӥ\��F�I�Ҧp�b�w�˱Ұ� sendmail �ɡA�p�G sendmail �L�k���ѪA�Ȫ��ɭԡA����L�k���ѪA�Ȫ����D�h�|�Q������n���ɷ����h�A�h�u�n���R�n���ɴN�i�H�A�Ѱ��D�I�A���ǥH�ѨM���D�աI( �ҥH�ڭ̱`���y�ѧU�ۧU�̡z�O�u���աI���(1)�ù��W�������~�T���P(2)�n���ɪ����~��T�A�X�G�i�H�ѨM�j������ Linux ���D�I )
�]���A�@�Ӧ��g�窺�D���z���A�|�H���H�a�d�\�@�U�ۤv���n���ɡA�H�H�ɴx���t�Ϊ��̷s�߰ʡI�����X�ӵn���ɦ����ǩO�H�@��Ө��A���U���X�ӡG
- �O���n����T�G�o�ӪF��۷������n�I�Ҧp�G���ѱz�� apache �o�� WWW �A�ȱ��F�A�A��D��ɱ������H�ӳ̫�n�J�̬O�֡H�I�o���i�H�ǥѤ��R apache ���n���ɨӨ��o��T�F���~�A�U�@���@�ѱz���t�γQ�J�I�A�åB�Q�Q�Ψӧ����L�H���D���A�o�ӮɭԹ�誺�D���d�X�O�z�� Linux �b�i��������欰�A�o�ӮɭԧA�n�p��i�����z���D���O�ѩ�Q�J�I�ҾɭP�����D�A�åB��U����~�ӷ��l�d�O�H�I�����I���ɵn���ɥi�O�۷����n���O�I
�n�F�A����O���F�o�ǵn���ɤ���A�ڭn��������R�r�I�H�W�A�@�Ӧn���t�κz���j�������D�y�@���D���t�d���A�ȳ̦n��ֺɶq���z�A�o�O����N��O�H�]�N�O���A�o���D�����l��D������N�M���t�d�l��u�@�A���n�ٷd WWW �A�ȡI�o�˦��X�Ӧn�B�A���F�t�Ϊ��w���ʸ��Τ��~�]�]���}�� port �ܤ֤F�I�^�A�O���ɪ��ѪR�]�|���²��I�]���ڭ̪� /var/log/secure �O�����n�J�̸�T�N�|������@�P�ʡI����ڭ̴N�i�H�d�ߤ@�U�C��n�J���ϥΪ̱b���ջP���~�T���յ������I�]���M�o�A�p�G�A���W�e���B�g���״I���ܡA����@���D���W���w�˩Ҧ��������A�Ȥ]�O�i�H���աI�^�W�A�ˬd/var/log/messages�B/var/log/secure�o�ǭ��ɮפ]�N�۷����F�I�]���t�εo�ͪ����~�Ϊ̬Oĵ�i�T���q�`���|�g�J�o���ɮפ��C
- /var/log/secure�G�O���n�J�t�Φs����ƪ��ɮסA�Ҧp pop3, ssh, telnet, ftp �����|�O���b���ɮפ��F
- /var/log/wtmp�G�O���n�J�̪��T����ơA�ѩ��ɮפw�g�Q�s�X�L�A�ҥH�����ϥ� last �o�ӫ��O�Ө��X�ɮת����e�F
- /var/log/messages�G�o���ɮ۷������n�A�X�G�t�εo�ͪ����~�T���]�Ϊ̬O���n����T�^���|�O���b�o���ɮפ��F
- /var/log/boot.log�G�O���}���Ϊ̬O�@�ǪA�ȱҰʪ��ɭԡA����ܪ��Ұʩ������T���F
- /var/log/maillog �� /var/log/mail/*�G�����l��s���Ω���( sendmail �P pop3 )���ϥΪ̰O���F
- /var/log/cron�G�o�ӬO�ΨӰO�� crontab �o�ӨҦ�ʪA�Ȫ����e���I
- /var/log/httpd, /var/log/news, /var/log/mysqld.log, /var/log/samba, /var/log/procmail.log�G ���O�O�X�Ӥ��P�������A�Ȫ��O���ɰաI
�@
���O�A�p�G�ڤ��䦳�ƤQ���D������H�ڭn���n�@���@���h��� log file �O�H�����I���˹�ݷ|���H�z��?�]���A�ڭ̩��U�]�ϥΤ@��²�����n���ɨӤ��R Red Hat �� Mandrake �o��� Linux distribution ���n���ɧa�I
[root @test
root]# ps -aux|grep syslog
root 782 0.0 0.8 1340 508 ? S Oct30 0:00 syslogd -m 0 root 11044 0.0 1.1 2408 732 pts/1 S 00:03 0:00 grep syslog |
[root @test
root]# vi /var/log/secure
Nov 4 16:28:35 test xinetd[7831]: START: telnet pid=7841 from=192.168.1.11 Nov 4 16:28:35 test xinetd[7841]: FAIL: telnet address from=192.168.1.11 Nov 4 23:41:17 test sshd[10803]: Accepted password for test from 192.168.1.11 port 3117 ssh2 Nov 4 23:41:17 test sshd(pam_unix)[10805]: session opened for user test by (uid=500) Nov 4 23:41:29 test su(pam_unix)[10838]: authentication failure; logname=test uid=500 euid=0 tty= ruser=test rhost= user=root Nov 4 23:41:34 test su(pam_unix)[10839]: session opened for user root by test(uid=500) |
�A�ȦW��.�T�����š@�@�@�s�����ܦa�I |
���D�@�G�p�G�ڭn�N�ڪ�mail��������Ƶ��L�g�J/var/log/maillog�����A����b/etc/syslog.conf�N�n�g���G
mail.info /var/log/maillog�`�N��W����A���ڭ̪����Ũϥ�info�ɡA����y����j��info����(�tinfo�o�ӵ���)���W���T���A���|�Q�g�J��᭱�����ɮפ����I�z�o�˥i�H�A�ѶܡH�]�N�O���A�ڭ̥i�H�N�Ҧ�mail���n����T�������b/var/log/maillog�̭����N��աI |
���D�G�G�ڭn�N�s�D�s�ո��(news)�ΨҦ�ʩR�O����T(cron)���g�J��@�Ӻ٬�/var/log/cronnews���ɮפ��A���O�o��ӵ{�Ǫ�ĵ�i�T���O���b/var/log/cronnews.warn�Ӧp��]�w�ڪ��ɮשO�H��²��աI�J�M�O��ӵ{�ǡA����u�n�H�����ӹj�}�F�A���~�A�ѩ�ĤG�ӫ��w�ɮפ��A�ڥu�n�O��ĵ�i�T���A�]���]�w�W�ݭn���w�y=�z�o�ӲŸ��A�ҥH�N�����F�G
news.*;cron.* /var/log/cronnews�W�����ӡy=�z�N�O�b���w���Ū��N��աI�ѩ���w�F���šA�]���A�u���o�ӵ��Ū��T���~�|�Q�����b�o���ɮ̭��O�I |
���D�T�G�ڪ�messages�o���ɮݭn�O���Ҧ�����T�A���O�N�O���Q�n�O��cron,mail��news����T�A�������ӫ��g�~�n�H�i�H����ؼg�k�A���O�O�G
*.*;news,cron,mail.none /var/log/messages�� *.*;news.none;cron.none;mail.none /var/log/messages�ϥΡy,�z���j�ɡA���ťu�n���b�̫�@�ӧY�i�A�p�G�O�H�y;�z�Ӥ����ܡA����N�ݭn�N�A�ȻP���ų��g�W�h�o�I�o�˷|�]�w�F�a�I |
�Ĥ@�ӨҤl�G�Ӧ� Red Hat
7.x ������ syslog.conf ���e�G
#kern.* /dev/console # �u�n�O kernel ���ͪ��T���A�������e�� console �h�I # �o�Ӷ��عw�]�O�������I���L�A�u�n�z�@�N�A�i�H�}�ҴN�O�F�I *.info;mail.none;authpriv.none;cron.none
/var/log/messages
authpriv.*
/var/log/secure
mail.*
/var/log/maillog
cron.*
/var/log/cron
*.emerg
*
uucp,news.crit
/var/log/spooler
local7.*
/var/log/boot.log
|
�ĤG�ӨҤl�G�Ӧ� Mandrake
9.0 �� syslog.conf ���e�I
# �U�بt�Ϊ��T�� # �U���T�椤�A���O�O�����O�G # 1. �Ĥ@��O�����O�����y�����T�{�z����T�A�u�n�O���y�n�J�z�D���A�Y�� # �y��J�b���P�K�X�z���{�ǮɡA���O���� auth.log �̭��h�F�A�o�������O���D�n���G # xinet(telnet, ftp), ssh, su, postfix, pop3 ���� # 2. �ĤG��h�O���F�����O������T���~�A��L�����ݭn�O���b/var/log/syslog�����I # 3. �ĤT��h�O�O���F���� user ���檺���O���I�s�t�Υ\��Ҳ��ͪ��Y�ǰT���I auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog user.* -/var/log/user.log # �o�ӳ����h�O�b�O�������T�I����W����
/var/log/syslog ���I���ƤF�I
# �����{�Ҹ�T�������T�����|�Q�����b
/var/log/secure �o���ɮ����A
# �����l��������T���|�����b���U�I���L�A�٬O�����T�ӵ��ŨӰO���A
# �o�ӳ����h�O�b�O������@�ǨҦ�ʩR�O���]�w���B�I
# �o�����O�O�������֤ߦ�������T�I�Ҧp�ڭ̦b�e�@�����쪺�Ҳո��J�A
# �o�O����L��������T�աI
# �o�O�s�D�s�եD������T
# ����o�ӴN�O����Ҧ��A�Ȭ������ɮ��o�I
# �N�Ҧ��w�g�e�{�y�Y�����~���T���z�H�Y���o�e���ثe�b�D���W��������H�I
# ����� Mandrake
Linux �������]�w�u��A����ܪ���T���|�Q�����b�o���ɮפ��I
|
[root @test
root]# chattr +a /var/log/messages
[root @test root]# lsattr /var/log/messages ----a--------- messages |
- logrotate�G
�n�F�I����ڭ̤w�g�N�n����Ƽg�J�F�O���ɤ��F�A�]�w�g�Q��chattr�]�w�Fa�o���ݩʤF�A����Ӧp��i�� log rotate ���u�@�O�I�H�o�̽ЯS�O�d�N���O�A syslog �D�O�Q�� demand ���覡�ӱҰʪ��A�����ݨD���ɭԥߨ�N�|�Q���檺�A���O log rotate �o�O�b�W�w���ɶ���F����~�Ӷi�� log files �� rotate �欰�A�ҥH�o�� logrotate �{�dz��O���b cron ���U�i�檺��I�o�@�I�ЯS�O�d�N��I�n�F�A���� logrotate �o�ӵ{�����ѼƳ]�w�ɦb���̩O�H�I�����I�Ҽ{��Ӧa����
�@�@
- /etc/logrotate.conf
- /etc/logrotate.d
�`�N�o�I���� logrotate.conf �~�O�D�n���Ѽ��ɮסA�ܩ� logrotate.d �O�@�ӥؿ��A�̭����Ҧ��ɮ׳��|�Q�D�ʪ�Ū�J /etc/logrotate.conf �����Ӷi��I�t�~�A�b/etc/logrotate.d�̭����ɮפ��A�p�G�S���W�w�쪺�@�Dzӳ��]�w�A�h�H/etc/logrotate.conf�o���ɮת��W�w�ӫ��w���w�]�ȡI�n�F�A���ڭ̴��� log rotate ���D�n�\��N�O�N�ª��n���ɮײ��ʦ����ɡA�åB���s�إߤ@�ӷs���Ū��ɮרӰO���A�L�����浲�G���I�������U���ϥܡG
�@�@
�ѤW�����ϥܧڭ̥i�H�M�������D�A���Ĥ@�����槹rotate����A�쥻��messages�|�ܦ�messages.1�ӥB�|�s�y�@�ӪŪ�messages���t�Ψ��x�s�n���ɡC�ӲĤG�����椧��A�hmessages.1�|�ܦ�messages.2��messages�|�ܦ�messages.1�A�S�y���@�ӪŪ�messages���x�s�n���ɡI����p�G�ڭ̶ȳ]�w�O�d�T�ӵn���ɦӤw���ܡA�������ĥ|���ɡA�hmessages.3�o���ɮ״N�|�Q�R���A�åѫ᭱�����s���O�s�n���ɩҨ��N�I���u�@�N�O�o�˰աI
�@
����h�[�i��@�� logrotate ���u�@�O�H��I�o�dz��O���b logrotate.conf �̭��A�ڭ̨Ӭݤ@�U�w�]�� logrotate �����e�a�I
�@�@
# ���U���]�w�O logrotate ���w�]�]�w�ȡA�p�G�ӧO���ɮ׳]�w�F��L���ѼơA
# ����N�H�ӧO���ɮ׳]�w���D�A�Y���ɮרS���]�w�쪺�ѼơA
# �h�H�o���ɮת����e���w�]�ȡI# �C��§���i��@�� rotate ���u�@
weekly# �O�d�X�ӵn���ɩO�H�w�]�O�O�d�|�ӡI
rotate 4# �O�_�إ߷s���n���ɨӰO���O�H�]���ڭ̭n�~��O���A�ҥH���M�O�إ��o�I
create# rotate���᪺�n���ɡA�n���n���Y�A�q�`�O���n���Y�աA
# ���O�p�G�A���t�Ϋܦ��L�A���ܧA���n���ɫ��e�j���ɭԡA
# ����̦n�N�O���L���Y�@�U������|���Ŷ��I
Compress# �N���U�o�ӥؿ������Ҧ��ɮ׳�Ū�i�Ӱ��� rotate ���u�@�I
include /etc/logrotate.d# �ܩ�n������T�����A���ϥ� last �Ӭ������n���̸�T�N�O�O���b�o���ɮפ��I
# ���U�N�O /var/log/wtmp �o���ɮת� rotate ���p�A�L���N��O�G
# 1. �C�Ӥ�i��@�� log rotate ���u�@�F
# 2. �N�ɮת��v���]�w�� 664 �o�I
# 3. �ȫO�s�e�@�Ӥ몺 rotate �ƥ��I�o�ӥi�H��j�@�I�A�Ҧp 5 �I�O�s���Ӥ�A�H�Q�l��
/var/log/wtmp {
monthly
create 0664 root utmp
rotate 1
}# ���U�o���ɮ� /var/log/wtmp �����I
/var/log/lastlog {
monthly
rotate 1
}
�ѳo���ɮת��]�w�ڭ̥i�H���D /etc/logrotate.d ���N�O�� /etc/logrotate.conf �ҳW���X�Ӫ��ؿ��A�ҥH�A���ڭ̥i�H�N�Ҧ�����Ƴ����L�g�J /etc/logrotate.conf �Y�i�A���O�o�ˤ@�ӳo���ɮ״N��b�O�ӽ����F�A�]���A�W�ߥX�Ӥ@�� RPM �M�� �N�@�� rotate �������ɮסA�����I���G�O����X�z���@�Ӥ�k�I�W������T�O�t�Ϊ��w�]rotate���p�A���L�A�z�i�H�ۦ檺�קאּ�ۤv���w���˦��A�Ҧp�A�p�G�z���t�Ϊ��Ŷ����j�A�åB��߰����H���b�Ȫ����D�A����i�H�G
�@�@
- �N rotate 4 �令 rotate 9 ���k�A�H�O�s���h���ƥ��ɮסF
- �j�������n���ɤ��ݭn compress �o�I���O�Ŷ��Ӥp�N�ݭn compress �I�ר�O�ܦ��w�ЪŶ���httpd��ݭncompress���I
�n�F�A�W���ڭ̤j�P���ФF /var/log/wtmp �o���ɮת��]�w�A���O�٬O���ܸԲӰաA�ҥH���U�ڭ̥H /etc/logrotate.d/syslog �o�ӽ��� syslog �o�ӪA�Ȫ��ɮסA�ӬݬݸӦp��]�w�L��rotate�O�G
�@�@
/var/log/auth.log /var/log/syslog /var/log/user.log /var/log/secure /var/log/messages /var/log/boot.log /var/log/mail/errors /var/log/mail/info /var/log/mail/warnings /var/log/cron/errors /var/log/cron/info /var/log/cron/warnings /var/log/kernel/errors /var/log/kernel/info /var/log/kernel/warnings /var/log/lpr/errors /var/log/lpr/info /var/log/lpr/warnings /var/log/news/news.err /var/log/news/news.notice /var/log/news/news.crit /var/log/daemons/errors /var/log/daemons/info /var/log/daemons/warnings /var/log/explanations {
�@�@�@�@sharedscripts
�@�@�@�@rotate 5
�@�@�@�@weekly
�@�@�@�@postrotate
�@�@�@�@/usr/bin/killall -HUP syslogd #
�@�@�@�@endscript
}
���T�� logrotate ���g�k���G
�@�@
- �N log file �W�١]�]�t������|�^�g�b�e���A�i�H�ϥΪťզr�����j�h�� log files �F
- �� { } �]�A�Ҧ����]�w�F
- �]�w�����ػP�e�����쪺�ۦP�A�åB�i�[�J rotate �e (pre) �P�� (post) ���@�ǯS�����檺���O�I
- prerotate�G�b�Ұ� logrotate ���e�i�檺���O�A�Ҧp�ק� log file ���ݩʡI�I
- postrotate�G�b���� logrotate ����Ұʪ����O�A�Ҧp���s�Ұʡ] kill -1 �� kill -HUP �^�Y�ӪA�ȡI
- Prerotate�Ppostrotate���w�g�[�W�F�S���ݩʪ��ɮ׳B�z�W���A�O�۷����n������{�ǡI
�ѩ�ڭ̤w�g�N�n���ɪ��ݩʳ]�w�Fchattr +a�A�ҥH���ݭn�blogrotate���e�N�o���ݩʮ����A�æblogrotate����A�A�N�o���ݩʥ[�^�h�I�ҥH�o�A����prerotate�Ppostrotate�N�㪺�۷������n�աI���]�ڭ̶Ȱw��/var/log�̭����X���ɮ׳]�w�ݩʡG
�@�@
- messages
- secure
- auth.log
�������Ӧp��ק�W����ܪ����e�O�H��I�A�i�H�o�˰��G
�@�@
/var/log/auth.log /var/log/syslog /var/log/user.log /var/log/secure /var/log/messages /var/log/boot.log /var/log/mail/errors /var/log/mail/info /var/log/mail/warnings /var/log/cron/errors /var/log/cron/info /var/log/cron/warnings /var/log/kernel/errors /var/log/kernel/info /var/log/kernel/warnings /var/log/lpr/errors /var/log/lpr/info /var/log/lpr/warnings /var/log/news/news.err /var/log/news/news.notice /var/log/news/news.crit /var/log/daemons/errors /var/log/daemons/info /var/log/daemons/warnings /var/log/explanations {
�@�@�@�@sharedscripts
�@�@�@�@rotate 5
�@�@�@�@weekly
�@�@�@�@prerotate
�@�@�@�@�@�@�@�@/usr/bin/chattr -a /var/log/auth.log
�@�@�@�@�@�@�@�@/usr/bin/chattr -a /var/log/messages
�@�@�@�@�@�@�@�@/usr/bin/chattr -a /var/log/secure
�@�@�@�@endscript
�@�@�@�@postrotate
�@�@�@�@�@�@�@�@/usr/bin/killall -HUP syslogd
�@�@�@�@�@�@�@�@/usr/bin/chattr +a /var/log/auth.log
�@�@�@�@�@�@�@�@/usr/bin/chattr +a /var/log/messages
�@�@�@�@�@�@�@�@/usr/bin/chattr +a /var/log/secure
�@�@�@�@endscript
}
�ݨ�_�H�N�O�����L�h�� a �o���ݩʡA�M�����F����A�A���L�[�J�o���ݩʡI�ЯS�O�d�N���O�A���� /usr/bin/killall �VHUP syslogd ���N�q�A�o�@�檺�ت��b��N�t�Ϊ� syslogd ���s�H��Ѽ��ɡ] syslog.conf �^�����Ū�J�@���I�]�i�H�Q���O reload ���N��աI�ѩ�ڭ̫إߤF�@�ӷs���Ū������ɡA�p�G�����榹�@��ӭ��s�ҰʪA�Ȫ��ܡA����O�����ɭԱN�|�o�Ϳ��~��I�I(�Ц^��귽�z�����`Ū�@�U kill �᭱�� signal �����e����)�I
�@
Logrotate�����աG
�n�F�A�]�w��������A�ڭ̨Ӵ��լݬݳo�˪��]�w�O�_�i��O�H���L���橳�U�����O�G
�@�@
[root @test root]# logrotate �Vf /etc/logrotate.conf
[root @test root]# lsattr /var/log/auth.log /var/log/messages /var/log/secure
----a--------- /var/log/auth.log
----a--------- /var/log/messages
----a--------- /var/log/secure
�W������ -f �㦳�y�j�����z���N��A�p�G�@�����]�w���S�����D���ܡA����z�פW�A�z�� /var/log �o�ӥؿ��N�|�_�ܤ��o�I�ӥB���Ӥ��|�X�{���~�T���~��I�K�K�I�o�˴N OK �F�I�ܴΤ��O�ܡH�I�n�F�A����w�]��logrotate����ɭ���O�H�����I���ξ�ߡA�t�Τw�g���ڭ̳]�w�n�F�I��b���̩O�H
�@/etc/cron.daily/logrotate
�@
�`�N�ݤ@�U�̭������e�G
�@/usr/sbin/logrotate /etc/logrotate.conf
�@
�ѩ� logrotate ���u�@�w�g�[�J crontab ���Y�F�I�ҥH�{�b�C�Ѩt�γ��|�۰ʪ����L�d�� logrotate �o�I���ξ�ߪ��աI�I�u�O�n�`�N�@�U���� /var/log/messages ���Y�O�_�`�`���G�yJun 23 04:02:00 test syslogd 1.4.1: restart.�z�o�˪��r�ˡI�H�o�������O syslogd ���s�Ұʪ��ɶ��ա]�N�O�]�� /etc/logrotate.d/syslog ���]�w���t�G�I�^
�@�@
���D�G�ڪ�/var/log/messages�u�Ʊ�O���@�Ǭ۷����n����T�A����cron�����e�w�g�b/var/log/cron�̭��O���F�A�ҥH�ڷQ�Ncron����T�����A����ӫ��ק�ڪ�syslog.conf���]�w�O�H
���G�W�A�A�i�H�o�˳]�w�աI[root @test root]# vi /etc/syslog.conf
�ק� /var/log/messages ���@��A�Ϧ������U���Ҽ˴N�i�H�F�I
*.info;mail.none;;news.none;authpriv.none;cron.none -/var/log/messages
[root @test root]# /etc/rc.d/init.d/syslog restart
�o�˴N�i�H�աI²�檺�ܡI
���D�G�N procmail �� logfile �]/var/log/procmail.log�^�[�J logrotate �����I���]�ڭ̤w�g�N procmail �[�J�� sendmail ���{�������F�A�åB�w�g�ҰʥL�A�o�ӮɭԡA�p�G�ڷQ�n�C�Ӥ������@�� logrotate �A�åB�O�d���Ӥ�����n����Ƴƥ��A���ӫ��@�O�H
���G�ϥ� vi �إߤ@���ɮסA�ɦW�� /etc/logrotate.d/procmail�A�o���ɮת����e���G# This file is creating by VBird 2002/06/18�W�������O�G
/var/log/procmail.log {
�@�@�@�@monthly
�@�@�@�@size=10M
�@�@�@�@rotate 5
�@�@�@�@nocompress
}1. �Y�ӵn���ɤu�@�W�L�@�Ӥ�F
2. �θӵn���ɤj�p�W�L 10 MB�F
3. �O�s���ӳƥ��ɮסF
4. �ƥ��ɮפ��n���Y�I�I�M���x�s�����}�A�o�ˤ@�ӡA�C�Ӥ�N�|�۰ʪ��N�n����Ƴƥ��U���o�I���ݭn���檺�աI������쪺�O���� size ���ѼơI�p�G�z���n���ɦѬO�ܤj���ɭԡA�i�H�Ҽ{�[�J size �o�ӰѼƻ��I�L�W����س��A���O�O�y k �P M �z�A�Шϥ� man logrotate �ӸԲӬd�ݤ@�U�Ϊk�o�I
- dmesg
�b���O�C�Ҧ�������Jdmesg�Y�i����I�ѩ�t�Φb�}�����L�{�����|���N�w�� mount �W�ӡA�ҥH�L�k�����N��ƪ������LŪ�� log file �����h�A���O���F�����W������K�A�ҥH�b�}�����L�{�������T���٬O�n�O���U�ӡA�o�ӮɭԨt�δN�N ram �}�F�@�Ӥp�϶����x�s�o�Ӹ���o�I�o�Ӷ}���O�����ɮ״N�O�G�y/proc/kmsg�z�աI�P�ɡA�w�]�� RAM ���϶��e�q�b���P���������ä��ۦP�A�ثe���w�]�����O 16KB ���j�p��
[root @test /root]# dmesg
�@
- last
����p�G�n�s�X�ӤW�Ӥ몺�n�J��ƩO�H�I�i�H�ϥΤW�����ĤG�ӽd�ҡI
[root @test /root]# last
�Ѽƻ����G
-number �Gnumber ���Ʀr�A�p�G�z���n�J�T���Ӧh�F�A�i�H�ϥγo�ӫ��O�I
�d�ҡG
[test @test /root]# last -5
test pts/0 192.168.1.2 Tue Apr 9 20:34 - 20:35 (00:01)
test pts/0 192.168.1.2 Tue Apr 9 20:14 - 20:30 (00:15)
test ftpd21546 192.168.1.2 Tue Apr 9 02:55 - 03:06 (00:10)
test ftpd15813 192.168.1.2 Tue Apr 9 01:20 - 01:21 (00:00)
test pts/0 192.168.1.2 Mon Apr 8 20:14 - 00:27 (04:13)
wtmp begins Tue Apr 2 01:12:26 2002
[root @test /root]# last -f /var/log/wtmp.1 <==�s�X�W�Ӥ몺�n�J��ơI
�ڪ��]�p�z����²��A�N�O��¤��R�ڭ̱`�`�ϥΪ��X�ӪA�ȡG
# 2.3a FTP
{for proftpd}
echo "========================== " >> $logfile echo "3. ���� FTP �n���ɪ��n�J���Ʋέp" >> $logfile echo "�b�� �ӷ���} ���� "|awk '{printf("\%-15s \%-25s \%-4s\n", $1, $2, $3)}' >> $logfile echo "FTP�n�J����: `cat $basedir/messageslog|grep "FTP session opened." | wc -l`"|awk '{printf( "\%-41s \%3d\n", $1, $2)}' >> $logfile # add login ip script cat $basedir/messageslog | grep "FTP session opened."|awk '{print $7}'|cut -d"[" -f2 | cut -d"]" -f1 >"$basedir/ftploginip" /bin/awk '{ for( i=0; i<1; i++ ) Number[$i]++ }; END{ for( course in Number ) printf( "\%-41s \%3d\n", course, Number[course])}' $basedir/ftploginip|sort +2 -gr |awk '{printf("\%-41s \%3d\n", $1, $2)}'>>$logfile echo " " >> $logfile echo "FTP�n�J���\�b��" >> $logfile cat $basedir/messageslog | grep "(ftp) session opened for user" | awk '{print $11}' > "$basedir/messagesftp" /bin/awk '{ for( i=0; i<1; i++ ) Number[$i]++ }; END{ for( course in Number ) printf( "\%-41s \%3d\n", course, Number[course])}' $basedir/messagesftp|sort +2 -gr|awk '{printf("\%-41s \%3d\n", $1, $2)}'>>$logfile echo " " >> $logfile cat $basedir/messageslog|grep "Authentication failure." >$basedir/ftperr cat $basedir/messageslog|grep "no such user '" >>$basedir/ftperr echo "FTP���~�n�J����:`cat $basedir/ftperr| wc -l`"|awk '{printf( "\%-41s \%3d\n", $1, $2)}' >> $logfile cat $basedir/ftperr|grep "failure."|awk '{print $7 " " $9}'|cut -d'[' -f2|cut -d':' -f1|awk '{print $2 " " $1}'|cut -d'M' -f2|cut -d']' -f1>"$basedir/ftpfail" /bin/awk '{ for( i=0; i<1; i++ ) Number[$i]++ }; END{ for( course in Number ) printf( "\%-15s \%3d\n", course, Number[course])}' $basedir/ftpfail|sort +2 -gr|awk '{printf("\%-15s \%-25s \%3d\n", $1, $2, $3)}'>>$logfile cat $basedir/ftperr|grep "no such user '"|awk '{print $7 " " $12}'|cut -d'[' -f2|awk '{print $2 " " $1}'|cut -d']' -f1>"$basedir/ftpxusr" /bin/awk '{ for( i=0; i<1; i++ ) Number[$i]++ }; END{ for( course in Number ) printf( "\%-15s \%3d\n", course, Number[course])}' $basedir/ftpxusr|sort +2 -gr|awk '{printf("\%-15s \%-25s \%3d\n", $1, $2, $3)}'>>$logfile echo " " >> $logfile |