ssh协议，Secure Shell
为客户提供安全的Shell环境
默认端口：TCP 22
OpenSSH 服务
服务名称 sshd
主程序 /usr/sbin/sshd /usr/bin/ssh
配置文件 /etc/ssh/sshd_config
/etc/ssh/ssh_config
ssh 选项 服务器
ssh 选项 用户名@服务器
ssh 选项 -l 用户名 服务器
-p 端口：连接到指定的端口
-X：启用X转发，在本机运行对方的图形程序
日志分类
由系统服务rsyslog系统管理，格式相似
用户日志
记录用户登录及退出系统的事件
程序日志
由各种服务/程序独立管理，要格式不统一
内核及系统日志-采用文本格式进行记录
用户日志
采用二进制的Data格式
无法用普通文本阅读工具来分析
程序日志
web服务器access_log error_log
...
日志分析工具
tail less grep等文本浏览/检索命令
awk sed等格式化过滤工具
专用分析工具
Webmin系统管理套件
Webalizer、AWStats等日志统计套件
跟踪新增日志消息 时时更新
tail -f
[[email protected] logrotate.d]# tail -f /var/log/messages
Aug 11 21:54:58 localhost tpvmlpd2[2258]: device type not supported
Aug 11 21:55:13 localhost tpvmlpd2[2259]: device type not supported
Aug 11 21:55:28 localhost tpvmlpd2[2260]: device type not supported
Aug 11 21:55:43 localhost tpvmlpd2[2261]: device type not supported
Aug 11 21:55:58 localhost tpvmlpd2[2262]: device type not supported
Aug 11 21:55:58 localhost tpvmlpd2[2060]: aborting
Aug 11 22:50:26 localhost kernel: Kernel logging (proc) stopped.
Aug 11 22:50:26 localhost rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="1756" x-info="http://www.rsyslog.com"] exiting on signal 15.
Aug 11 22:50:26 localhost kernel: imklog 5.8.10, log source = /proc/kmsg started.
Aug 11 22:50:26 localhost rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="2412" x-info="http://www.rsyslog.com"] start
用户日志分析
users who w
查看已登录的用户信息 详细度不同
last lastb 命令
[[email protected] logrotate.d]# users
root
[[email protected] logrotate.d]# who
root pts/0 2016-08-11 22:17 (192.168.100.1)
[[email protected] logrotate.d]# w
23:48:56 up 1:58, 1 user, load average: 0.00, 0.00, 0.00
USER TTY FROM [email protected] IDLE JCPU PCPU WHAT
root pts/0 192.168.100.1 22:17 0.00s 0.43s 0.04s w
[[email protected] logrotate.d]# last -4
root pts/0 192.168.100.1 Thu Aug 11 22:17 still logged in
reboot system boot 2.6.32-358.el6.x Thu Aug 11 21:50 - 23:49 (01:58)
root pts/0 192.168.100.1 Thu Aug 11 00:40 - crash (21:09)
root pts/1 192.168.100.1 Thu Aug 11 00:37 - 00:40 (00:03)
wtmp begins Tue Aug 9 01:31:10 2016
[[email protected] logrotate.d]# lastb -2
btmp begins Tue Aug 9 00:20:07 2016
内核及系统日志分析
时间标签 主机名 程序名 消息内容
[[email protected] logrotate.d]# tail -2 /var/log/messages
Aug 11 23:52:53 localhost yum[2471]: Installed: mailcap-2.1.31-2.el6.noarch
Aug 11 23:53:04 localhost yum[2471]: Installed: httpd-2.2.15-26.el6.centos.x86_64
rsyslog日志服务
[[email protected] ~]# rpm -qa|grep rsyslog
rsyslog-5.8.10-6.el6.x86_64
主程序 /sbin/rsyslogd
配置文件 /etc/rsyslog.conf
[[email protected] ~]# grep -vE ‘^#|^$‘ /etc/rsyslog.conf
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog # provides kernel logging support (previously done by rklogd)
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg *
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
$template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
:programname, startswith, "spice-vdagent" /var/log/spice-vdagent.log;SpiceTmpl
*.* /var/log/admin.log
日志消息分8个优先级
数值越小，事件越紧急/重要
[[email protected] ~]# man 2 syslog |grep ‘KERN_‘
#define KERN_EMERG "<0>" /* system is unusable */
#define KERN_ALERT "<1>" /* action must be taken immediately */
#define KERN_CRIT "<2>" /* critical conditions */
#define KERN_ERR "<3>" /* error conditions */
#define KERN_WARNING "<4>" /* warning conditions */
#define KERN_NOTICE "<5>" /* normal but significant condition */
#define KERN_INFO "<6>" /* informational */
#define KERN_DEBUG "<7>" /* debug-level messages */
/etc/rsyslog.conf格式
设备.优先级 记录位置
循环备份机制
logrotate轮转
减小日志文件大小 降低分析难度
丢弃过期日志以节省空间
结合cron计划任务每天执行
[[email protected] ~]# rpm -ql logrotate |grep /etc
/etc/cron.daily/logrotate 每日计划执行脚本
/etc/logrotate.conf 主配置文件
/etc/logrotate.d 存放用户定义的策略
[[email protected] ~]# vim /etc/logrotate.conf
/var/log/wtmp { 启用轮转日志文件
monthly 每月轮转一次
create 0664 root utmp 建立新文件并设权限
minsize 1M 日志达到1MB才开始轮转
rotate 1 只保留一个备份
}
手工执行轮转
[[email protected] ~]# logrotate /etc/logrotate.conf
[[email protected] ~]# /etc/init.d/rsyslog restart
关闭系统日志记录器： [确定]
启动系统日志记录器： [确定]
[[email protected] ~]# tail -1 /etc/rsyslog.conf
*.*/var/log/admin.log
[[email protected] ~]#