CentOS 7文件系统与日志分析详解(3)

配置文件：/etc/rsyslog.conf

[root@localhost ~]# vim /etc/rsyslog.conf //查看日志文件配置信息 # rsyslog configuration file # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html # If you experience problems, see #### MODULES #### # The imjournal module bellow is now used as a message source instead of imuxsock. $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $ModLoad imjournal # provides access to the systemd journal #$ModLoad imklog # reads kernel messages (the same are read from journald) #$ModLoad immark # provides --MARK-- message capability # Provides UDP syslog reception #$ModLoad imudp #$UDPServerRun 514 # Provides TCP syslog reception #$ModLoad imtcp #$InputTCPServerRun 514 #### GLOBAL DIRECTIVES #### # Where to place auxiliary files $WorkDirectory /var/lib/rsyslog # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat ...//省略部分内容... [root@localhost ~]# cd /var/log //查看日志文件目录 [root@localhost log]# ls anaconda dmesg libvirt rhsm tallylog Xorg.0.log audit dmesg.old maillog sa tuned Xorg.0.log.old boot.log firewalld messages samba vmware-vgauthsvc.log.0 Xorg.1.log btmp gdm ntpstats secure vmware-vmsvc.log Xorg.9.log chrony glusterfs pluto speech-dispatcher vmware-vmusr.log yum.log cron grubby_prune_debug ppp spooler wpa_supplicant.log cups lastlog qemu-ga sssd wtmp [root@localhost log]# last root pts/0 192.168.144.1 Mon Sep 2 05:17 still logged in reboot system boot 3.10.0-693.el7.x Mon Sep 2 05:17 - 05:58 (00:40) root pts/0 192.168.144.1 Mon Sep 2 04:11 - crash (01:05) root :0 :0 Mon Sep 2 04:11 - crash (01:05) reboot system boot 3.10.0-693.el7.x Mon Sep 2 04:10 - 05:58 (01:47) root pts/0 :0 Sun Aug 25 01:10 - 01:10 (00:00) root :0 :0 Sun Aug 25 01:10 - crash (8+03:00) ...//省略部分内容...

lastb查看用户登录次数日志

[root@localhost log]# lastb root :0 :0 Sun Aug 25 01:10 - 01:10 (00:00) root :1 :1 Sat Aug 10 06:26 - 06:26 (00:00) btmp begins Sat Aug 10 06:26:22 2019

查看程序日志文件

1、安装httpd服务，搭建Apache网站服务；然后关闭防火墙，使宿主机可以访问

[root@localhost ~]# yum install httpd -y //安装httpd服务 已加载插件：fastestmirror, langpacks Loading mirror speeds from cached hostfile * base: centos.ustc.edu.cn * extras: centos.ustc.edu.cn * updates: centos.ustc.edu.cn 正在解决依赖关系 --> 正在检查事务 ---> 软件包 httpd.x86_64.0.2.4.6-89.el7.centos.1 将被 安装 ...//省略部分内容... [root@localhost ~]# systemctl start httpd //开启服务 [root@localhost ~]# systemctl stop firewalld.service //关闭防火墙 [root@localhost ~]# setenforce 0 [root@localhost ~]# cd /var/log //查看日志文件目录,看是否生成httpd日志闻文件目录 [root@localhost log]# ls anaconda dmesg lastlog qemu-ga sssd wtmp audit dmesg.old libvirt rhsm tallylog Xorg.0.log boot.log firewalld maillog sa tuned Xorg.0.log.old btmp gdm messages samba vmware-vgauthsvc.log.0 Xorg.1.log chrony glusterfs ntpstats secure vmware-vmsvc.log Xorg.9.log cron grubby_prune_debug pluto speech-dispatcher vmware-vmusr.log yum.log cups httpd ppp spooler wpa_supplicant.log

2、通过宿主机访问搭建的网站后，查看系统程序的日志文件