Différences
Ci-dessous, les différences entre deux révisions de la page.
| Prochaine révision | Révision précédente | ||
| elearning:workbooks:centos:8:junior:l122 [2024/10/01 07:39] – created admin | elearning:workbooks:centos:8:junior:l122 [2024/10/01 08:03] (Version actuelle) – created admin | ||
|---|---|---|---|
| Ligne 5: | Ligne 5: | ||
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LCF602 - Gestion | + | ======LCF602 - Gestion |
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| - | * **LCF602 - Gestion | + | * **LCF602 - Gestion |
| - | * Contenu du Module | + | * Présentation |
| - | * Rôle du noyau | + | * La Commande dmesg |
| - | * LAB #1 - Modules | + | * LAB #1 - Surveillance Sécuritaire |
| - | * LAB #2 - Compilation et installation du noyau et des modules | + | * 1.1 - La Commande last |
| - | * 2.1 - Déplacer /home | + | * 1.2 - La Commande lastlog |
| - | * 2.2 - Préparer l' | + | * 1.3 - La Commande lastb |
| - | * 2.3 - Préparer l' | + | * 1.4 - Le Fichier / |
| - | * Le Fichier | + | * 1.5 - Gestion des évènements audit |
| - | * Le Fichier Makefile | + | * Le fichier / |
| - | * 2.4 - Paramétrage du noyau | + | |
| - | * 2.5 - Compiler le Noyau | + | * auditctl |
| - | * 2.6 - Installer le Nouveau Noyau | + | * audispd |
| - | * LAB #3 - Gestion des Quotas | + | * La consultation des événements audit |
| - | * 3.1 - La Commande quotacheck | + | * La Commande aureport |
| - | * 3.2 - La Commande edquota | + | * La Commande ausearch |
| - | * 3.3 - La Commande quotaon | + | |
| - | * 3.4 - La Commande repquota | + | * Applications |
| - | * 3.5 - La Commande quota | + | * LAB #2 - rsyslog |
| - | * 3.6 - La Commande warnquota | + | * 2.1 - Priorités |
| + | * 2.2 - Sous-systèmes applicatifs | ||
| + | * 2.3 - / | ||
| + | * Modules | ||
| + | * Directives Globales | ||
| + | * Règles | ||
| + | * Sous-système applicatif.Priorité | ||
| + | * Sous-système applicatif!Priorité | ||
| + | * Sous-système applicatif=Priorité | ||
| + | * L' | ||
| + | * n Sous-systèmes avec la même priorité | ||
| + | * n Sélecteurs avec la même Action | ||
| + | * LAB #3 - La Commande logger | ||
| + | * LAB #4 - La Commande logrotate | ||
| + | * LAB #5 - La Journalisation avec journald | ||
| + | * 5.1 - Consultation des Journaux | ||
| + | * 5.2 - Consultation des Journaux d'une Application Spécifique | ||
| + | * 5.3 - Consultation des Journaux depuis le Dernier Démarrage | ||
| + | * 5.4 - Consultation des Journaux d'une Priorité Spécifique | ||
| + | * 5.5 - Consultation des Journaux d'une Plage de Dates ou d' | ||
| + | * 5.6 - Consultation des Journaux en Live | ||
| + | * 5.7 - Consultation des Journaux avec des Mots Clefs | ||
| - | =====Rôle du noyau===== | + | =====Présentation===== |
| - | Le noyau ou //kernel// est la partie | + | La majorité des journaux |
| - | | + | <WRAP center round important 60%> |
| - | * la prise en charge | + | **Important** : Il est conseillé de déplacer le point de montage du répertoire **/ |
| - | * l'ajout de fonctionnalités, | + | </ |
| - | * l'optimisation du code, | + | |
| - | * la correction de bogues, | + | =====La Commande / |
| - | * le besoin d'une fonctionnalité expérimentale. | + | |
| - | + | Cette commande retourne les messages du noyau (**//Kernel Ring Buffer//**) stockés dans le fichier **/ | |
| - | Commencez par mettre à jour CentOS 8 : | + | |
| < | < | ||
| - | [root@centos8 ~]# dnf update | + | [root@centos8 ~]# dmesg | more |
| - | ... | + | [ 0.000000] Linux version 4.18.0-240.22.1.el8_3.x86_64 (mockbuild@kbuilder.bsys.centos.org) (gcc version 8.3.1 20191121 (Red Hat 8.3.1-5) (G |
| - | [root@centos8 ~]# reboot | + | CC)) #1 SMP Thu Apr 8 19:01:30 UTC 2021 |
| + | [ | ||
| + | shkernel=auto resume=UUID=c8bb3f47-d67f-4b21-b781-766899dc83d4 rhgb quiet | ||
| + | [ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' | ||
| + | [ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' | ||
| + | [ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' | ||
| + | [ 0.000000] x86/fpu: xstate_offset[2]: | ||
| + | [ 0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using ' | ||
| + | [ 0.000000] BIOS-provided physical RAM map: | ||
| + | [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable | ||
| + | [ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved | ||
| + | [ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved | ||
| + | [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000dffeffff] usable | ||
| + | [ 0.000000] BIOS-e820: [mem 0x00000000dfff0000-0x00000000dfffffff] ACPI data | ||
| + | [ 0.000000] BIOS-e820: [mem 0x00000000fec00000-0x00000000fec00fff] reserved | ||
| + | [ 0.000000] BIOS-e820: [mem 0x00000000fee00000-0x00000000fee00fff] reserved | ||
| + | [ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved | ||
| + | [ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000011fffffff] usable | ||
| + | [ 0.000000] NX (Execute Disable) protection: active | ||
| + | [ 0.000000] SMBIOS 2.5 present. | ||
| + | [ 0.000000] DMI: innotek GmbH VirtualBox/ | ||
| + | [ 0.000000] Hypervisor detected: KVM | ||
| + | --More-- | ||
| </ | </ | ||
| - | Identifiez ensuite le noyau utilisé par votre machine virtuelle | + | Les option de cette commande sont : |
| < | < | ||
| - | [root@centos8 ~]# uname -r | + | [root@centos8 ~]# dmesg --help |
| - | 4.18.0-305.7.1.el8_4.x86_64 | + | |
| - | </ | + | |
| - | =====LAB #1 - Modules===== | + | Usage: |
| + | dmesg [options] | ||
| - | Dans le cas d'une utilisation courante de Linux, il est cependant préférable de faire appel aux **modules**. Les modules se trouvent dans le répertoire **/ | + | Display or control the kernel ring buffer. |
| - | <code> | + | Options: |
| - | [root@centos8 ~]# ls / | + | -C, --clear |
| - | bls.conf | + | -c, --read-clear |
| - | build modules.builtin.bin | + | -D, --console-off |
| - | config | + | -E, --console-on |
| - | kernel | + | -F, --file |
| - | modules.alias | + | -f, --facility < |
| - | modules.alias.bin | + | -H, --human |
| - | modules.block | + | -k, --kernel |
| - | </code> | + | -L, --color[=< |
| + | | ||
| + | -l, --level < | ||
| + | -n, --console-level < | ||
| + | -P, --nopager | ||
| + | -p, --force-prefix | ||
| + | -r, --raw print the raw message buffer | ||
| + | -S, --syslog | ||
| + | -s, --buffer-size < | ||
| + | -u, --userspace | ||
| + | -w, --follow | ||
| + | -x, --decode | ||
| + | -d, --show-delta | ||
| + | -e, --reltime | ||
| + | -T, --ctime | ||
| + | -t, --notime | ||
| + | | ||
| + | | ||
| + | Suspending/ | ||
| - | Les commandes pour manipuler les modules sont : | + | -h, --help |
| + | -V, --version | ||
| - | * insmod | + | Supported log facilities: |
| - | * rmmod | + | kern - kernel messages |
| - | | + | user - random user-level messages |
| - | | + | mail - mail system |
| + | | ||
| + | auth - security/ | ||
| + | | ||
| + | lpr - line printer subsystem | ||
| + | news - network news subsystem | ||
| - | Par exemple | + | Supported log levels (priorities): |
| + | emerg - system is unusable | ||
| + | alert - action must be taken immediately | ||
| + | crit - critical conditions | ||
| + | err - error conditions | ||
| + | warn - warning conditions | ||
| + | notice - normal but significant condition | ||
| + | info - informational | ||
| + | debug - debug-level messages | ||
| - | < | + | For more details see dmesg(1). |
| - | [root@centos8 ~]# lsmod | + | |
| - | Module | + | |
| - | xt_CHECKSUM | + | |
| - | ipt_MASQUERADE | + | |
| - | xt_conntrack | + | |
| - | ipt_REJECT | + | |
| - | nft_compat | + | |
| - | nf_nat_tftp | + | |
| - | nft_objref | + | |
| - | nf_conntrack_tftp | + | |
| - | nft_counter | + | |
| - | tun 53248 1 | + | |
| - | bridge | + | |
| - | stp 16384 1 bridge | + | |
| - | llc 16384 2 bridge, | + | |
| - | nft_fib_inet | + | |
| - | nft_fib_ipv4 | + | |
| - | nft_fib_ipv6 | + | |
| - | nft_fib | + | |
| - | nft_reject_inet | + | |
| - | nf_reject_ipv4 | + | |
| - | nf_reject_ipv6 | + | |
| - | nft_reject | + | |
| - | nft_ct | + | |
| - | nf_tables_set | + | |
| - | nft_chain_nat | + | |
| - | nf_nat | + | |
| - | nf_conntrack | + | |
| - | nf_defrag_ipv6 | + | |
| - | nf_defrag_ipv4 | + | |
| - | ip_set | + | |
| - | nf_tables | + | |
| - | nfnetlink | + | |
| - | sunrpc | + | |
| - | ext4 761856 | + | |
| - | mbcache | + | |
| - | jbd2 131072 | + | |
| - | virtio_balloon | + | |
| - | pcspkr | + | |
| - | i2c_piix4 | + | |
| - | joydev | + | |
| - | ip_tables | + | |
| - | xfs 1515520 | + | |
| - | libcrc32c | + | |
| - | sr_mod | + | |
| - | sd_mod | + | |
| - | cdrom 65536 1 sr_mod | + | |
| - | t10_pi | + | |
| - | sg | + | |
| - | ata_generic | + | |
| - | bochs_drm | + | |
| - | drm_vram_helper | + | |
| - | drm_kms_helper | + | |
| - | syscopyarea | + | |
| - | sysfillrect | + | |
| - | sysimgblt | + | |
| - | fb_sys_fops | + | |
| - | drm_ttm_helper | + | |
| - | ttm | + | |
| - | drm | + | |
| - | ahci | + | |
| - | libahci | + | |
| - | virtio_net | + | |
| - | net_failover | + | |
| - | ata_piix | + | |
| - | serio_raw | + | |
| - | failover | + | |
| - | libata | + | |
| - | dm_mirror | + | |
| - | dm_region_hash | + | |
| - | dm_log | + | |
| - | dm_mod | + | |
| - | fuse 151552 | + | |
| </ | </ | ||
| - | Pour ajouter un module, on peut utiliser la commande **insmod** ou **modprobe**. Cette dernière ajoute non seulement le module passé en argument mais également ses dépendances : | + | =====LAB #1 - Surveillance Sécuritaire===== |
| - | < | + | ====1.1 - La Commande last==== |
| - | [root@centos8 ~]# modprobe bonding | + | |
| - | [root@centos8 ~]# lsmod | more | + | |
| - | Module | + | |
| - | bonding | + | |
| - | xt_CHECKSUM | + | |
| - | ipt_MASQUERADE | + | |
| - | xt_conntrack | + | |
| - | ipt_REJECT | + | |
| - | nft_compat | + | |
| - | nf_nat_tftp | + | |
| - | nft_objref | + | |
| - | nf_conntrack_tftp | + | |
| - | nft_counter | + | |
| - | tun 53248 1 | + | |
| - | bridge | + | |
| - | stp 16384 1 bridge | + | |
| - | llc 16384 2 bridge, | + | |
| - | nft_fib_inet | + | |
| - | nft_fib_ipv4 | + | |
| - | nft_fib_ipv6 | + | |
| - | nft_fib | + | |
| - | nft_reject_inet | + | |
| - | nf_reject_ipv4 | + | |
| - | nf_reject_ipv6 | + | |
| - | --More-- | + | |
| - | </ | + | |
| - | Pour supprimer un module, on peut utiliser la commande **rmmod** ou **modprobe -r**. Cette dernière essaie de supprimer les dépendances non-utilisées | + | Cette commande |
| < | < | ||
| - | [root@centos8 ~]# modprobe -r bonding | + | [root@centos8 ~]# last |
| - | [root@centos8 ~]# lsmod | more | + | trainee |
| - | Module | + | reboot |
| - | xt_CHECKSUM | + | trainee |
| - | ipt_MASQUERADE | + | trainee |
| - | xt_conntrack | + | reboot |
| - | ipt_REJECT | + | trainee |
| - | nft_compat | + | reboot |
| - | nf_nat_tftp | + | trainee |
| - | nft_objref | + | reboot |
| - | nf_conntrack_tftp | + | trainee |
| - | nft_counter | + | trainee |
| - | tun 53248 1 | + | reboot |
| - | bridge | + | trainee |
| - | stp 16384 1 bridge | + | trainee |
| - | llc 16384 | + | trainee |
| - | nft_fib_inet | + | trainee |
| - | nft_fib_ipv4 | + | reboot |
| - | nft_fib_ipv6 | + | trainee |
| - | nft_fib | + | trainee |
| - | nft_reject_inet | + | trainee |
| - | nf_reject_ipv4 | + | trainee |
| - | nf_reject_ipv6 | + | trainee |
| - | nft_reject | + | trainee |
| - | --More-- | + | trainee |
| + | trainee | ||
| + | trainee | ||
| + | reboot | ||
| + | trainee | ||
| + | reboot | ||
| + | trainee | ||
| + | reboot | ||
| + | reboot | ||
| + | |||
| + | wtmp begins Fri May 8 08:13:49 2020 | ||
| </ | </ | ||
| - | Les dépendances des modules | + | Les option de cette commande |
| < | < | ||
| - | [root@centos8 ~]# more / | + | [root@centos8 ~]# last --help |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | xz kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | kernel/ | + | |
| - | _64.ko.xz | + | |
| - | kernel/ | + | |
| - | --More--(0%) | + | |
| - | </ | + | |
| - | Il est possible d' | + | Usage: |
| + | last [options] [< | ||
| - | < | + | Show a listing |
| - | [root@centos8 ~]# modinfo bonding | + | |
| - | filename: | + | |
| - | author: | + | |
| - | description: | + | |
| - | license: | + | |
| - | alias: | + | |
| - | rhelversion: | + | |
| - | srcversion: | + | |
| - | depends: | + | |
| - | intree: | + | |
| - | name: | + | |
| - | vermagic: | + | |
| - | sig_id: | + | |
| - | signer: | + | |
| - | sig_key: | + | |
| - | sig_hashalgo: | + | |
| - | signature: | + | |
| - | B7: | + | |
| - | 3F: | + | |
| - | BE: | + | |
| - | 44: | + | |
| - | DE: | + | |
| - | 7F: | + | |
| - | D8: | + | |
| - | BA: | + | |
| - | B8: | + | |
| - | 8F: | + | |
| - | 58: | + | |
| - | 6E: | + | |
| - | 50: | + | |
| - | 2F: | + | |
| - | CA: | + | |
| - | 0C: | + | |
| - | A6: | + | |
| - | AE: | + | |
| - | 59: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | parm: | + | |
| - | </ | + | |
| - | Dernièrement, les fichiers dans le repertoire **/etc/modprobe.d** sont utilisés pour spécifier les options éventuelles à passer aux modules lors de leur chargement ainsi que les alias utilisés pour leur faire référence | + | Options: |
| + | | ||
| + | -a, --hostlast | ||
| + | -d, --dns translate the IP number back into a hostname | ||
| + | -f, --file < | ||
| + | -F, --fulltimes | ||
| + | -i, --ip | ||
| + | -n, --limit < | ||
| + | -R, --nohostname | ||
| + | -s, --since < | ||
| + | -t, --until < | ||
| + | -p, --present < | ||
| + | -w, --fullnames | ||
| + | -x, --system | ||
| + | | ||
| + | | ||
| - | < | + | -h, --help |
| - | [root@centos8 ~]# ls / | + | -V, --version |
| - | firewalld-sysctls.conf | + | |
| - | kvm.conf | + | |
| - | [root@centos8 ~]# cat / | + | For more details see last(1). |
| - | # Setting modprobe kvm_intel/ | + | |
| - | # only enables Nested Virtualization until the next reboot or | + | |
| - | # module reload. Uncomment the option applicable | + | |
| - | # to your system below to enable the feature permanently. | + | |
| - | # | + | |
| - | # User changes in this file are preserved across upgrades. | + | |
| - | # | + | |
| - | # For Intel | + | |
| - | #options kvm_intel nested=1 | + | |
| - | # | + | |
| - | # For AMD | + | |
| - | #options kvm_amd nested=1 | + | |
| </ | </ | ||
| - | =====LAB #2 - Compilation et installation du noyau et des modules===== | + | ====1.2 - La Commande lastlog==== |
| - | Activez le dépôt **CentOS-Linux-PowerTools** en passant | + | Cette commande indique les dates et heures de la connexion au système la plus récente des utilisateurs |
| < | < | ||
| - | [root@centos8 ~]# vi / | + | [root@centos8 ~]# lastlog |
| - | [root@centos8 ~]# cat /etc/ | + | Username |
| - | # CentOS-Linux-PowerTools.repo | + | root pts/0 Thu Jun 3 09: |
| - | # | + | bin **Never logged in** |
| - | # The mirrorlist system uses the connecting IP address of the client and the | + | daemon |
| - | # update status of each mirror to pick current mirrors that are geographically | + | adm **Never logged in** |
| - | # close to the client. | + | lp |
| - | # manually picking other mirrors. | + | sync |
| - | # | + | shutdown |
| - | # If the mirrorlist does not work for you, you can try the commented out | + | halt |
| - | # baseurl line instead. | + | mail |
| - | + | operator | |
| - | [powertools] | + | games **Never logged in** |
| - | name=CentOS Linux $releasever - PowerTools | + | ftp **Never logged in** |
| - | mirrorlist=http:/ | + | nobody |
| - | # | + | dbus |
| - | gpgcheck=1 | + | systemd-coredump |
| - | enabled=1 | + | systemd-resolve |
| - | gpgkey=file:/// | + | tss **Never logged in** |
| + | polkitd | ||
| + | unbound | ||
| + | libstoragemgmt | ||
| + | cockpit-ws | ||
| + | sssd | ||
| + | setroubleshoot | ||
| + | sshd | ||
| + | chrony | ||
| + | tcpdump | ||
| + | trainee | ||
| + | cockpit-wsinstance | ||
| + | rngd | ||
| + | gluster | ||
| + | qemu | ||
| + | rpc **Never logged in** | ||
| + | rpcuser | ||
| + | saslauth | ||
| + | radvd **Never logged in** | ||
| + | dnsmasq | ||
| + | fenestros2 | ||
| + | fenestros1 | ||
| + | apache | ||
| </ | </ | ||
| - | Installez maintenant les paquets nécessaires | + | Les option de cette commande sont : |
| < | < | ||
| - | [root@centos8 ~]# dnf groupinstall " | + | [root@centos8 ~]# lastlog --help |
| - | ... | + | Usage: lastlog |
| - | [root@centos8 ~]# dnf install asciidoc audit-libs-devel bash bc binutils binutils-devel bison diffutils elfutils elfutils-devel elfutils-libelf-devel findutils flex gawk gcc gettext gzip hmaccalc hostname make module-init-tools ncurses-devel net-tools newt-devel numactl-devel openssl patch pciutils-devel perl perl-ExtUtils-Embed pesign redhat-rpm-config rpm-build rpmdevtools sh-utils tar xmlto xz zlib-devel rpmdevtools | + | |
| - | ... | + | Options: |
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | -u, --user LOGIN print lastlog record of the specified LOGIN | ||
| </ | </ | ||
| - | ====2.1 - Déplacer /home==== | + | ====1.3 - La Commande lastb==== |
| - | <WRAP center round alert 60%> | + | Cette commande indique les dates et heures des connexions infructueuses des utilisateurs à partir du contenu du fichier |
| - | **Important** - Il n'est pas conseillé de compiler en tant que root pour des raisons de sécurité. Pour pouvoir utiliser le compte d'un utilisateur pour créer un nouveau noyau, celui-ci doit disposer de plus de 10 Go d' | + | |
| - | </ | + | |
| - | <WRAP center round todo 60%> | + | <code> |
| - | **A faire** | + | [root@centos8 ~]# lastb |
| - | </WRAP> | + | trainee |
| + | trainee | ||
| + | trqinee | ||
| + | |||
| + | btmp begins Thu Jun 3 09:51:07 2021 | ||
| + | </code> | ||
| - | Créez ensuite une seule partition sur **/ | + | Les options de cette commande sont : |
| < | < | ||
| - | [root@centos8 ~]# fdisk /dev/sdc | + | [root@centos8 ~]# lastb --help |
| - | Welcome to fdisk (util-linux 2.32.1). | + | Usage: |
| - | Changes will remain in memory only, until you decide to write them. | + | lastb [options] [< |
| - | Be careful before using the write command. | + | |
| - | Device does not contain | + | Show a listing of last logged in users. |
| - | Created a new DOS disklabel with disk identifier 0xc321702b. | + | |
| - | Command (m for help): n | + | Options: |
| - | Partition type | + | -< |
| - | p | + | -a, --hostlast |
| - | e | + | -d, --dns translate the IP number back into a hostname |
| - | Select (default | + | -f, --file < |
| + | -F, --fulltimes | ||
| + | -i, --ip | ||
| + | -n, --limit < | ||
| + | -R, --nohostname | ||
| + | -s, --since < | ||
| + | -t, --until < | ||
| + | -p, --present < | ||
| + | -w, --fullnames | ||
| + | -x, --system | ||
| + | | ||
| + | | ||
| - | Using default response p. | + | -h, --help |
| - | Partition number (1-4, default 1): | + | -V, --version |
| - | First sector (2048-41943039, default 2048): | + | |
| - | Last sector, +sectors or +size{K, | + | |
| - | Created a new partition | + | For more details see last(1). |
| - | + | ||
| - | Command (m for help): w | + | |
| - | The partition table has been altered. | + | |
| - | Calling ioctl() to re-read partition table. | + | |
| - | Syncing disks. | + | |
| </ | </ | ||
| - | Créez maintenant un système de fichiers ext4 sur **/dev/sdc1** : | + | ====1.4 - Le Fichier |
| - | < | + | Sous RHEL/CentOS ce fichier contient la journalisation des opérations de gestion des authentifications |
| - | [root@centos8 ~]# mkfs.ext4 | + | |
| - | mke2fs 1.45.6 (20-Mar-2020) | + | |
| - | Discarding device blocks: done | + | |
| - | Creating filesystem with 16776960 4k blocks and 4194304 inodes | + | |
| - | Filesystem UUID: dc92c0d7-919b-4fff-8719-53e9e7e628dd | + | |
| - | Superblock backups stored on blocks: | + | |
| - | 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, | + | |
| - | 4096000, 7962624, 11239424 | + | |
| - | Allocating group tables: done | + | < |
| - | Writing inode tables: done | + | [root@centos8 ~]# tail -n 15 / |
| - | Creating journal | + | Jun 3 09:01:20 centos8 sshd[905]: Server listening on :: port 22. |
| - | Writing superblocks and filesystem accounting information: done | + | Jun 3 09:01:39 centos8 sshd[1585]: Accepted password for trainee from 10.0.2.2 port 52734 ssh2 |
| + | Jun 3 09:01:39 centos8 systemd[1590]: | ||
| + | Jun 3 09:01:39 centos8 sshd[1585]: pam_unix(sshd: | ||
| + | Jun 3 09:01:46 centos8 su[1627]: pam_systemd(su-l: | ||
| + | Jun 3 09:01:46 centos8 su[1627]: pam_unix(su-l: | ||
| + | Jun 3 09:51:05 centos8 login[1158]: | ||
| + | Jun 3 09:51:05 centos8 login[1158]: | ||
| + | Jun 3 09:51:07 centos8 login[1158]: | ||
| + | Jun 3 09:51:18 centos8 unix_chkpwd[2400]: | ||
| + | Jun 3 09:51:18 centos8 login[1158]: | ||
| + | Jun 3 09:51:20 centos8 login[1158]: | ||
| + | Jun 3 09:51:45 centos8 login[1158]: | ||
| + | Jun 3 09:51:45 centos8 login[1158]: | ||
| + | Jun 3 09:51:47 centos8 login[1158]: FAILED LOGIN SESSION FROM tty1 FOR trainee | ||
| </ | </ | ||
| - | Montez **/ | + | ====1.5 - Gestion des Evénements audit==== |
| - | < | + | ===Le fichier |
| - | [root@centos8 ~]# mount /dev/sdc1 /mnt | + | |
| - | </code> | + | |
| - | Copiez | + | Ce fichier contient les messages du système d' |
| - | < | + | * des appels système, |
| - | [root@centos8 ~]# cp -a /home/* /mnt | + | * des accès aux fichiers, |
| - | </ | + | * des informations en provenance de %%SELinux%%. |
| - | Démontez | + | Consultez maintenant le fichier **/var/log/audit.log** |
| < | < | ||
| - | [root@centos8 ~]# umount | + | [root@centos8 ~]# tail -n 15 /var/ |
| - | [root@centos8 ~]# mv /home /root | + | type=PROCTITLE msg=audit(1622728321.894: |
| + | type=USER_START msg=audit(1622728321.901: | ||
| + | type=CRED_REFR msg=audit(1622728321.902: | ||
| + | type=CRED_DISP msg=audit(1622728321.908: | ||
| + | type=USER_END msg=audit(1622728321.910: | ||
| + | type=SERVICE_STOP msg=audit(1622728330.965: | ||
| + | type=USER_ACCT msg=audit(1622728381.954: | ||
| + | type=CRED_ACQ msg=audit(1622728381.954: | ||
| + | type=LOGIN msg=audit(1622728381.954: | ||
| + | type=SYSCALL msg=audit(1622728381.954: | ||
| + | type=PROCTITLE msg=audit(1622728381.954: | ||
| + | type=USER_START msg=audit(1622728381.960: | ||
| + | type=CRED_REFR msg=audit(1622728381.962: | ||
| + | type=CRED_DISP msg=audit(1622728381.966: | ||
| + | type=USER_END msg=audit(1622728381.968: | ||
| </ | </ | ||
| - | Identifiez l'UUID de / | + | La gestion des événements audit se repose sur trois exécutables |
| - | < | + | ===auditd=== |
| - | [root@centos8 ~]# ls -l / | + | |
| - | lrwxrwxrwx. 1 root root 10 Jul 19 12:02 f76d6b66-985b-4a91-af9c-4987e8c1443c -> ../../sdc | + | |
| - | [root@centos8 ~]# | + | |
| - | </ | + | |
| - | Editez | + | Cet exécutable est le daemon du système audit. Il est responsable de l’écriture des enregistrements audit sur disque. Son fichier |
| < | < | ||
| - | [root@centos8 ~]# vi /etc/fstab | + | [root@centos8 ~]# cat /etc/audit/auditd.conf |
| - | [root@centos8 ~]# cat /etc/fstab | + | |
| # | # | ||
| - | # / | + | # This file controls the configuration of the audit daemon |
| - | # Created by anaconda on Wed Jun 16 06:21:32 2021 | + | |
| # | # | ||
| - | # Accessible filesystems, | + | |
| - | # See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info. | + | local_events = yes |
| - | # | + | write_logs = yes |
| - | # After editing this file, run ' | + | log_file = /var/log/audit/audit.log |
| - | # units generated from this file. | + | log_group = root |
| - | # | + | log_format = ENRICHED |
| - | / | + | flush = INCREMENTAL_ASYNC |
| - | UUID=1c04981e-5317-4b73-9695-3ce25246835d /boot | + | freq = 50 |
| - | /dev/mapper/cl_centos8-swap swap swap defaults | + | max_log_file = 8 |
| - | UUID=f76d6b66-985b-4a91-af9c-4987e8c1443c | + | num_logs = 5 |
| + | priority_boost = 4 | ||
| + | name_format = NONE | ||
| + | ##name = mydomain | ||
| + | max_log_file_action = ROTATE | ||
| + | space_left = 75 | ||
| + | space_left_action = SYSLOG | ||
| + | verify_email = yes | ||
| + | action_mail_acct = root | ||
| + | admin_space_left = 50 | ||
| + | admin_space_left_action = SUSPEND | ||
| + | disk_full_action = SUSPEND | ||
| + | disk_error_action = SUSPEND | ||
| + | use_libwrap = yes | ||
| + | ## | ||
| + | tcp_listen_queue = 5 | ||
| + | tcp_max_per_addr = 1 | ||
| + | ## | ||
| + | tcp_client_max_idle = 0 | ||
| + | transport | ||
| + | krb5_principal = auditd | ||
| + | ## | ||
| + | distribute_network = no | ||
| + | q_depth = 400 | ||
| + | overflow_action = SYSLOG | ||
| + | max_restarts = 10 | ||
| + | plugin_dir | ||
| </ | </ | ||
| - | Créez le point de montage /home : | + | Les option |
| < | < | ||
| - | [root@centos8 ~]# mkdir /home | + | [root@centos8 ~]# auditd --help |
| + | auditd: unrecognized option ' | ||
| + | Usage: auditd [-f] [-l] [-n] [-s disable|enable|nochange] [-c < | ||
| </ | </ | ||
| - | Montez | + | ===auditctl=== |
| + | |||
| + | Cet exécutable est utilisé pour configurer les règles du système audit. Au démarrage, auditctl lit et applique les règles contunues dans le fichier **/etc/audit/ | ||
| < | < | ||
| - | [root@centos8 ~]# mount -a | + | [root@centos8 ~]# cat /etc/audit/audit.rules |
| - | [root@centos8 ~]# mount | + | ## This file is automatically generated from /etc/audit/rules.d |
| - | sysfs on /sys type sysfs (rw, | + | -D |
| - | proc on /proc type proc (rw, | + | -b 8192 |
| - | devtmpfs on /dev type devtmpfs (rw, | + | -f 1 |
| - | securityfs on /sys/kernel/security type securityfs (rw, | + | --backlog_wait_time 60000 |
| - | tmpfs on /dev/shm type tmpfs (rw, | + | |
| - | devpts on /dev/pts type devpts (rw, | + | |
| - | tmpfs on /run type tmpfs (rw, | + | |
| - | tmpfs on / | + | |
| - | cgroup on / | + | |
| - | pstore on / | + | |
| - | bpf on /sys/fs/bpf type bpf (rw, | + | |
| - | cgroup on / | + | |
| - | cgroup on / | + | |
| - | cgroup on / | + | |
| - | cgroup on / | + | |
| - | cgroup on / | + | |
| - | cgroup on / | + | |
| - | cgroup on / | + | |
| - | cgroup on / | + | |
| - | cgroup on / | + | |
| - | cgroup on / | + | |
| - | cgroup on / | + | |
| - | none on / | + | |
| - | configfs on / | + | |
| - | / | + | |
| - | selinuxfs on / | + | |
| - | mqueue on /dev/mqueue type mqueue (rw, | + | |
| - | hugetlbfs on / | + | |
| - | debugfs on / | + | |
| - | systemd-1 on / | + | |
| - | fusectl on / | + | |
| - | /dev/sda1 on /boot type ext4 (rw, | + | |
| - | sunrpc on / | + | |
| - | tmpfs on / | + | |
| - | tmpfs on / | + | |
| - | gvfsd-fuse on / | + | |
| - | tmpfs on /run/user/0 type tmpfs (rw, | + | |
| - | gvfsd-fuse on / | + | |
| - | /dev/sdc1 on /home type ext4 (rw, | + | |
| </ | </ | ||
| - | Notez la taille | + | Les options |
| < | < | ||
| - | [root@centos8 ~]# df -h | + | [root@centos8 ~]# auditctl |
| - | Filesystem | + | usage: auditctl [options] |
| - | devtmpfs | + | -a < |
| - | tmpfs 1.9G | + | -A < |
| - | tmpfs 1.9G 9.4M 1.9G 1% /run | + | -b < |
| - | tmpfs 1.9G 0 1.9G 0% / | + | |
| - | / | + | -c Continue through errors in rules |
| - | / | + | -C f=f Compare collected fields if available: |
| - | tmpfs 374M | + | |
| - | tmpfs 374M 1.2M 373M 1% / | + | -d < |
| - | / | + | l=task, |
| + | a=never, | ||
| + | -D Delete all rules and watches | ||
| + | -e [0..2] Set enabled flag | ||
| + | -f [0..2] Set failure flag | ||
| + | 0=silent | ||
| + | -F f=v Build rule: field name, operator(=, | ||
| + | > | ||
| + | -h Help | ||
| + | -i Ignore errors when reading rules from file | ||
| + | -k < | ||
| + | -l List rules | ||
| + | -m text Send a user-space message | ||
| + | -p [r|w|x|a] | ||
| + | | ||
| + | -q < | ||
| + | -r < | ||
| + | -R < | ||
| + | -s Report status | ||
| + | -S syscall | ||
| + | -t Trim directory watches | ||
| + | -v Version | ||
| + | -w < | ||
| + | -W < | ||
| + | --loginuid-immutable | ||
| + | --backlog_wait_time | ||
| + | | ||
| </ | </ | ||
| - | <WRAP center round todo 60%> | + | ===La consultation des événements audit=== |
| - | **A faire** - **Déconnectez-vous** de votre session **CentOS8_ROOT_10.0.2.45** et re-connectez-vous à la VM en tant que trainee en utilisant la connexion | + | |
| - | </ | + | La consultation des événements audit se fait en utilisant les commandes |
| - | ====2.2 - Préparer l' | + | ==La Commande aureport== |
| - | Pour créer l' | + | Cette commande |
| < | < | ||
| - | [trainee@centos8 ~]$ rpmdev-setuptree | + | [root@centos8 ~]# aureport |
| - | ...> | + | |
| - | [trainee@centos8 ~]$ ls -laR rpmbuild/ | + | |
| - | rpmbuild/: | + | |
| - | total 28 | + | |
| - | drwxrwxr-x. | + | |
| - | drwxr-xr-x. 17 trainee trainee 4096 Jul 19 12:10 .. | + | |
| - | drwxrwxr-x. | + | |
| - | drwxrwxr-x. | + | |
| - | drwxrwxr-x. | + | |
| - | drwxrwxr-x. | + | |
| - | drwxrwxr-x. | + | |
| - | rpmbuild/ | + | Summary Report |
| - | total 8 | + | ====================== |
| - | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . | + | Range of time in logs: 05/08/2020 08: |
| - | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | + | Selected time for report: 05/08/2020 08:13:52 - 06/ |
| - | + | Number of changes in configuration: | |
| - | rpmbuild/ | + | Number of changes to accounts, groups, or roles: 56 |
| - | total 8 | + | Number of logins: 21 |
| - | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . | + | Number of failed logins: 5 |
| - | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | + | Number of authentications: 50 |
| - | + | Number of failed authentications: | |
| - | rpmbuild/ | + | Number of users: 3 |
| - | total 8 | + | Number of terminals: 10 |
| - | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . | + | Number of host names: 4 |
| - | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | + | Number of executables: 22 |
| - | + | Number of commands: 11 | |
| - | rpmbuild/ | + | Number of files: 0 |
| - | total 8 | + | Number of AVC's: 0 |
| - | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . | + | Number of MAC events: 35 |
| - | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | + | Number of failed syscalls: 0 |
| - | + | Number of anomaly events: 7 | |
| - | rpmbuild/ | + | Number of responses to anomaly events: 0 |
| - | total 8 | + | Number of crypto events: 287 |
| - | drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 . | + | Number of integrity events: 0 |
| - | drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .. | + | Number of virt events: 0 |
| + | Number of keys: 0 | ||
| + | Number of process IDs: 616 | ||
| + | Number of events: 6030 | ||
| </ | </ | ||
| - | Téléchargez le rpm source du noyau : | + | Les options de cette commande sont : |
| < | < | ||
| - | [trainee@centos8 ~]$ uname -a | + | [root@centos8 ~]# aureport --help |
| - | Linux centos8.ittraining.loc 4.18.0-305.7.1.el8_4.x86_64 #1 SMP Tue Jun 29 21:55:12 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux | + | usage: aureport [options] |
| + | -a, | ||
| + | -au, | ||
| + | --comm Commands run report | ||
| + | -c, | ||
| + | -cr, | ||
| + | -e, | ||
| + | -f, | ||
| + | --failed only failed events in report | ||
| + | -h, | ||
| + | --help help | ||
| + | -i, | ||
| + | -if, | ||
| + | --input-logs Use the logs even if stdin is a pipe | ||
| + | --integrity Integrity event report | ||
| + | -l, | ||
| + | -k, | ||
| + | -m, | ||
| + | -ma, | ||
| + | -n, | ||
| + | -nc, | ||
| + | --node <node name> | ||
| + | -p, | ||
| + | -r, | ||
| + | -s, | ||
| + | --success only success events in report | ||
| + | --summary sorted totals for main object in report | ||
| + | -t, | ||
| + | -te,--end [end date] [end time] ending date & time for reports | ||
| + | -tm, | ||
| + | -ts, | ||
| + | --tty Report about tty keystrokes | ||
| + | -u, | ||
| + | -v, | ||
| + | --virt Virtualization report | ||
| + | -x, | ||
| + | If no report is given, the summary report will be displayed | ||
| + | </code> | ||
| - | [trainee@centos8 ~]$ cat / | + | ==La Commande ausearch== |
| - | CentOS Linux release 8.4.2105 | + | |
| - | [trainee@centos8 ~]$ wget https:// | + | Cette commande est utilisée pour rechercher des événements. Par exemple, pour rechercher |
| - | --2021-07-14 02: | + | |
| - | Resolving vault.centos.org (vault.centos.org)... 81.171.33.194, 2a05: | + | |
| - | Connecting to vault.centos.org (vault.centos.org)|81.171.33.194|: | + | |
| - | HTTP request sent, awaiting response... 200 OK | + | |
| - | Length: 123000617 (117M) [application/ | + | |
| - | Saving to: ‘kernel-4.18.0-305.7.1.el8_4.src.rpm’ | + | |
| - | + | ||
| - | kernel-4.18.0-305.7.1. 100%[===========================> | + | |
| - | + | ||
| - | 2021-07-14 02:55:33 (1.49 MB/s) - ‘kernel-4.18.0-305.7.1.el8_4.src.rpm’ saved [123000617/ | + | |
| - | </ | + | |
| - | + | ||
| - | Installez maintenant | + | |
| < | < | ||
| - | [trainee@centos8 ~]$ su - | + | [root@centos8 ~]# ausearch -ui 1000 | more |
| - | Mot de passe : fenestros | + | ---- |
| + | time-> | ||
| + | type=USER_AUTH msg=audit(1598972728.209: | ||
| + | omain addr=? terminal=pts/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_ACCT msg=audit(1598972728.214: | ||
| + | ost.localdomain addr=? terminal=pts/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=CRED_ACQ msg=audit(1598972728.218: | ||
| + | dr=? terminal=pts/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_START msg=audit(1598972728.223: | ||
| + | ,pam_xauth acct=" | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_END msg=audit(1598973013.687: | ||
| + | pam_xauth acct=" | ||
| + | ---- | ||
| + | time-> | ||
| + | type=CRED_DISP msg=audit(1598973013.687: | ||
| + | ddr=? terminal=pts/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_AUTH msg=audit(1618847281.847: | ||
| + | ng.loc addr=? terminal=pts/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_ACCT msg=audit(1618847281.847: | ||
| + | 8.ittraining.loc addr=? terminal=pts/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=CRED_ACQ msg=audit(1618847281.847: | ||
| + | ddr=? terminal=pts/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_START msg=audit(1618847281.883: | ||
| + | ,pam_xauth acct=" | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_END msg=audit(1618848279.544: | ||
| + | ,pam_xauth acct=" | ||
| + | ---- | ||
| + | time-> | ||
| + | type=CRED_DISP msg=audit(1618848279.544: | ||
| + | | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_AUTH msg=audit(1618848357.204: | ||
| + | addr=? terminal=pts/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_AUTH msg=audit(1618848363.134: | ||
| + | ng.loc addr=? terminal=pts/ | ||
| + | ---- | ||
| + | --More-- | ||
| + | </ | ||
| - | [root@centos8 ~]# dnf install yum-utils | + | Les options de cette commande sont : |
| - | ... | + | |
| - | + | ||
| - | [root@centos8 ~]# yum-builddep / | + | |
| - | ... | + | |
| - | </ | + | |
| - | + | ||
| - | Installez maintenant le paquet **kernel-4.18.0-305.7.1.el8_4.src.rpm** | + | |
| < | < | ||
| - | [root@centos8 ~]# exit | + | [root@centos8 ~]# ausearch --help |
| - | logout | + | usage: ausearch |
| - | [trainee@centos8 ~]$ rpm -Uvh kernel-4.18.0-305.7.1.el8_4.src.rpm | + | -a,--event <Audit event id> |
| - | Updating / installing... | + | --arch < |
| - | 1:kernel-4.18.0-305.7.1.el8_4 | + | -c,--comm <Comm name> |
| - | warning: group mockbuild does not exist - using root | + | --checkpoint < |
| - | warning: user mockbuild does not exist - using root | + | --debug Write malformed events that are skipped to stderr |
| - | warning: group mockbuild does not exist - using root | + | -e,--exit <Exit code or errno> |
| - | warning: user mockbuild does not exist - using root | + | -f,--file <File name> |
| - | warning: group mockbuild does not exist - using root | + | --format [raw|default|interpret|csv|text] results format options |
| - | warning: user mockbuild does not exist - using root | + | -ga,--gid-all <all Group id> |
| - | warning: group mockbuild does not exist - using root | + | -ge,--gid-effective < |
| - | warning: user mockbuild does not exist - using root | + | group id |
| - | warning: group mockbuild does not exist - using root | + | -gi,--gid <Group Id> |
| - | warning: user mockbuild does not exist - using root | + | -h,--help help |
| - | warning: group mockbuild does not exist - using root | + | -hn,--host <Host Name> |
| - | warning: user mockbuild does not exist - using root | + | -i,--interpret Interpret results to be human readable |
| - | warning: group mockbuild does not exist - using root | + | -if,--input <Input File name> |
| - | warning: user mockbuild does not exist - using root | + | --input-logs Use the logs even if stdin is a pipe |
| - | warning: group mockbuild does not exist - using root | + | --just-one Emit just one event |
| - | warning: user mockbuild does not exist - using root | + | -k,--key <key string> |
| - | warning: | + | -l, --line-buffered Flush output on every line |
| - | warning: user mockbuild does not exist - using root | + | -m,--message |
| - | warning: group mockbuild does not exist - using root | + | -n,--node <Node name> |
| - | warning: user mockbuild does not exist - using root | + | -o,--object |
| - | warning: | + | -p,--pid <Process id> |
| - | warning: user mockbuild does not exist - using root | + | -pp,--ppid <Parent Process id> |
| - | warning: group mockbuild does not exist - using root | + | -r,--raw output is completely unformatted |
| - | warning: user mockbuild does not exist - using root | + | -sc,--syscall <SysCall name> |
| - | warning: | + | -se,--context <SE Linux context> search based on either subject or |
| - | warning: user mockbuild does not exist - using root | + | object |
| - | warning: group mockbuild does not exist - using root | + | --session <login session id> |
| - | warning: user mockbuild does not exist - using root | + | -su,--subject <SE Linux context> search based on context of the Subject |
| - | warning: group mockbuild does not exist - using root | + | -sv,--success <Success Value> |
| - | warning: user mockbuild does not exist - using root | + | success value |
| - | warning: group mockbuild does not exist - using root | + | -te, |
| - | warning: user mockbuild does not exist - using root | + | -ts,--start [start date] [start time] starting data & time for search |
| - | warning: group mockbuild does not exist - using root | + | -tm, |
| - | warning: user mockbuild does not exist - using root | + | -ua, |
| - | warning: group mockbuild does not exist - using root | + | -ue,--uid-effective < |
| - | warning: user mockbuild does not exist - using root | + | user id |
| - | warning: group mockbuild does not exist - using root | + | -ui,--uid <User Id> |
| - | warning: user mockbuild does not exist - using root | + | -ul,--loginuid <login id> |
| - | warning: group mockbuild does not exist - using root | + | -uu,--uuid <guest UUID> |
| - | warning: user mockbuild does not exist - using root | + | machine with the given UUID. |
| - | warning: group mockbuild does not exist - using root | + | -v, |
| - | warning: user mockbuild does not exist - using root | + | -vm, |
| - | warning: group mockbuild does not exist - using root | + | machine with the name. |
| - | warning: user mockbuild does not exist - using root | + | -w,--word string matches are whole word |
| - | warning: group mockbuild does not exist - using root | + | -x, |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | ################################# | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| - | warning: user mockbuild does not exist - using root | + | |
| - | warning: group mockbuild does not exist - using root | + | |
| </ | </ | ||
| <WRAP center round important 60%> | <WRAP center round important 60%> | ||
| - | **Important** | + | **Important** |
| </ | </ | ||
| - | ====2.3 - Préparer l' | + | =====Le fichier / |
| - | Naviguez vers le repertoire **~/ | + | Ce fichier contient |
| < | < | ||
| - | [trainee@centos7 | + | [root@centos8 |
| - | [trainee@centos7 SPECS]$ rpmbuild | + | Jun 3 10:15:01 centos8 systemd[1]: session-76.scope: |
| - | ... | + | Jun 3 10:16:01 centos8 systemd[1]: Started Session 77 of user trainee. |
| + | Jun 3 10:16:01 centos8 systemd[1]: session-77.scope: Succeeded. | ||
| + | Jun 3 10:17:01 centos8 systemd[1]: Started Session 78 of user trainee. | ||
| + | Jun 3 10:17:01 centos8 systemd[1]: session-78.scope: Succeeded. | ||
| + | Jun 3 10:18:01 centos8 systemd[1]: Started Session 79 of user trainee. | ||
| + | Jun 3 10:18:01 centos8 systemd[1]: session-79.scope: Succeeded. | ||
| + | Jun 3 10:19:01 centos8 systemd[1]: Started Session 80 of user trainee. | ||
| + | Jun 3 10:19:01 centos8 systemd[1]: session-80.scope: Succeeded. | ||
| + | Jun 3 10:20:02 centos8 systemd[1]: Started Session 81 of user trainee. | ||
| + | Jun 3 10:20:02 centos8 systemd[1]: session-81.scope: | ||
| + | Jun 3 10:21:01 centos8 systemd[1]: Started Session 82 of user trainee. | ||
| + | Jun 3 10:21:01 centos8 systemd[1]: session-82.scope: | ||
| + | Jun 3 10:22:01 centos8 systemd[1]: Started Session 83 of user trainee. | ||
| + | Jun 3 10:22:01 centos8 systemd[1]: session-83.scope: Succeeded. | ||
| </ | </ | ||
| - | A l'issu du processus, examinez l' | + | =====Applications===== |
| + | |||
| + | Certaines applications consignent leurs journaux dans des répertoires spécifiques. Par exemple | ||
| + | |||
| + | * cups, | ||
| + | * httpd, | ||
| + | * samba, | ||
| + | * ... | ||
| < | < | ||
| - | [trainee@centos8 | + | [root@centos8 |
| - | total 812 | + | total 2448 |
| - | drwxr-xr-x. | + | drwxr-xr-x. |
| - | drwxr-xr-x. 3 trainee trainee | + | drwx------. 2 root |
| - | drwxr-xr-x. | + | -rw-------. 1 root |
| - | drwxr-xr-x. 3 trainee trainee | + | -rw-------. 1 root |
| - | drwxr-xr-x. 2 trainee trainee | + | -rw-------. 1 root |
| - | -rw-r--r--. | + | -rw-------. 1 root |
| - | -rw-r--r--. | + | -rw-------. 1 root |
| - | drwxr-xr-x. 2 trainee trainee | + | -rw-rw----. 1 root |
| - | -rw-r--r--. | + | -rw-rw----. 1 root |
| - | -rw-r--r--. | + | drwxr-xr-x. |
| - | drwxr-xr-x. | + | -rw-------. 1 root |
| - | drwxr-xr-x. 119 trainee trainee | + | -rw-------. 1 root |
| - | drwxr-xr-x. 137 trainee trainee | + | -rw-------. 1 root |
| - | drwxr-xr-x. | + | -rw-------. 1 root |
| - | drwxr-xr-x. 73 trainee trainee | + | -rw-------. 1 root |
| - | -rw-r--r--. | + | -rw-r--r--. 1 root |
| - | -rw-r--r--. | + | -rw-------. 1 root |
| - | -rw-r--r--. | + | -rw-------. 1 root |
| - | -rw-r--r--. | + | -rw-r--r--. 1 root |
| - | -rw-r--r--. | + | -rw-r--r--. 1 root |
| - | drwxr-xr-x. 30 trainee trainee | + | -rw-r-----. 1 root |
| - | drwxr-xr-x. | + | drwxr-xr-x. 2 root |
| - | drwxr-xr-x. 2 trainee trainee | + | -rw-------. 1 root |
| - | -rw-r--r--. | + | -rw-r--r--. 1 root |
| - | -rw-r--r--. | + | -rw-------. 1 root |
| - | drwxr-xr-x. 19 trainee trainee | + | -rw-------. 1 root |
| - | drwxr-xr-x. | + | -rw-rw-r--. 1 root |
| - | drwxr-xr-x. 5 trainee trainee | + | drwx------. 3 root |
| - | -rw-r--r--. | + | -rw-------. 1 root |
| - | -rw-r--r--. | + | -rw-------. 1 root |
| - | -rw-r--r--. | + | -rw-------. |
| - | -rw-r--r--. | + | -rw-------. 1 root |
| - | -rw-r--r--. | + | -rw-------. 1 root |
| - | drwxr-xr-x. 3 trainee trainee | + | -rw-------. 1 root |
| - | drwxr-xr-x. | + | -rw-------. 1 root |
| - | -rw-r--r--. | + | -rw-------. 1 root |
| - | drwxr-xr-x. 28 trainee trainee | + | drwx------. 2 root |
| - | -rw-r--r--. | + | drwx------. 3 root |
| - | drwxr-xr-x. | + | -rw-------. 1 root |
| - | drwxr-xr-x. 10 trainee trainee | + | -rw-------. 1 root |
| - | drwxr-xr-x. 26 trainee trainee | + | -rw-------. |
| - | drwxr-xr-x. | + | -rw-------. 1 root |
| - | drwxr-xr-x. | + | -rw-------. 1 root |
| - | drwxr-xr-x. 4 trainee trainee | + | -rw-------. 1 root |
| + | -rw-------. 1 root | ||
| + | -rw-------. 1 root | ||
| + | drwxr-x---. 2 sssd | ||
| + | drwxr-xr-x. | ||
| + | drwxr-xr-x. 2 root | ||
| + | -rw-rw-r--. 1 root | ||
| </ | </ | ||
| - | ===Le Fichier .config=== | + | =====LAB #2 - rsyslog===== |
| - | Changez | + | **rsyslog**, |
| - | < | + | rsyslog apporte des améliorations par rapport à syslogd : |
| - | [trainee@centos8 SPECS]$ cd ~/ | + | |
| - | </ | + | |
| - | Copiez le fichier | + | |
| + | | ||
| + | * l' | ||
| - | < | + | Les messages de journalisation envoyés à rsyslog sont marqués avec un **Sous-système applicatif** et une **Priorité**. Le binôme Sous-système applicatif/Priorité s' |
| - | [trainee@centos8 linux-4.18.0-305.7.1.el8.x86_64]$ cp configs/kernel-4.18.0-`uname -m`.config .config | + | |
| - | </ | + | |
| - | Mettez | + | rsyslog décide ensuite de l' |
| + | |||
| + | * ignorer les informations, | ||
| + | * envoyer les informations à un rsyslog sur une autre machine (par exemple, **@machine2**), | ||
| + | * inscrire les informations dans un fichier | ||
| + | * transmettre les informations | ||
| + | * transmettre les informations à tous les utilisateurs (par exemple *****), | ||
| + | * transmettre les informations à une application liée à rsyslog via un tube (par exemple, **|logrotate**). | ||
| + | |||
| + | Sous RHEL/ | ||
| < | < | ||
| - | [trainee@centos8 | + | [root@centos8 |
| - | scripts/kconfig/conf --oldconfig Kconfig | + | # Options for rsyslogd |
| - | # | + | # Syslogd options are deprecated since rsyslog v3. |
| - | # configuration written to .config | + | # If you want to use them, switch to compatibility mode 2 by "-c 2" |
| - | # | + | # See rsyslogd(8) for more details |
| + | SYSLOGD_OPTIONS="" | ||
| </ | </ | ||
| - | <WRAP center round important 60%> | + | L' |
| - | **Important** - Cette commande lit le fichier .config du noyau actuel et le compare | + | |
| - | </ | + | |
| - | La configuration du noyau se trouve dans un fichier dénommé **.config**. Le fichier **.config** est généré par une des trois commandes suivantes et ne doit **pas** être édité manuellement : | + | ^ Directive ^ Version ^ |
| + | | SYSLOGD_OPTIONS=" | ||
| + | | SYSLOGD_OPTIONS=" | ||
| + | | SYSLOGD_OPTIONS=" | ||
| - | * make config | + | ====2.1 - Priorités==== |
| - | * make menuconfig | + | |
| - | * make xconfig | + | |
| - | + | ||
| - | Exécutez la commande **make menuconfig** : | + | |
| - | < | + | La **Priorité** permet d' |
| - | [trainee@centos8 linux-4.18.0-305.7.1.el8.x86_64]$ make menuconfig | + | |
| - | UPD | + | |
| - | HOSTCC | + | |
| - | HOSTCC | + | |
| - | HOSTCC | + | |
| - | HOSTCC | + | |
| - | HOSTCC | + | |
| - | HOSTCC | + | |
| - | HOSTCC | + | |
| - | HOSTLD | + | |
| - | scripts/ | + | |
| - | # | + | |
| - | # using defaults found in / | + | |
| - | # | + | |
| - | </ | + | |
| - | Dans l' | + | ^ Niveau ^ Priorité ^ Description ^ |
| + | | 0 | emerg/panic | Système inutilisable | | ||
| + | | 1 | alert | Action immédiate requise | | ||
| + | | 2 | crit | Condition critique atteinte | | ||
| + | | 3 | err/error | Erreurs rencontrées | | ||
| + | | 4 | warning/ | ||
| + | | 5 | notice | Condition normale - message important | | ||
| + | | 6 | info | Condition normale - message simple | | ||
| + | | 7 | debug | Condition normale - message | ||
| - | * **y**, | + | ====2.2 - Sous-systèmes applicatifs==== |
| - | * la fonctionalité est incluse dans le noyau monolithique ou dans le cas d'une dépendance d'un module, dans le module concerné, | + | |
| - | * **m**, | + | |
| - | * la fonctionalité est incluse en tant que module, | + | |
| - | * **n**, | + | |
| - | * la fonctionalité n'est pas incluse. | + | |
| - | <WRAP center round important 60%> | + | Le **Sous-système applicatif**, aussi appelé **facility**, |
| - | **Important** - Cette commande | + | |
| - | </ | + | |
| - | + | ||
| - | Sauvegardez simplement la configuration actuelle et sortez de l'interface | + | |
| - | < | + | ^ Fonction ^ Description ^ |
| - | *** End of the configuration. | + | | auth/ |
| - | *** Execute | + | | cron | Message de cron ou at | |
| - | </ | + | | daemon | Message d'un daemon | |
| + | | kern | Message du noyau | | ||
| + | | lpr | Message du système d'impression | | ||
| + | | mail | Message du système de mail | | ||
| + | | news | Message du système de news | | ||
| + | | syslog | Message interne de rsyslogd | | ||
| + | | user | Message utilisateur | | ||
| + | | uucp | Message du système UUCP | | ||
| + | | local0 - local7 | Réservés pour des utilisations locales | | ||
| - | Vérifiez que le fichier **.config** a été" créé par l' | ||
| - | < | + | ====2.3 - / |
| - | [trainee@centos8 linux-4.18.0-305.7.1.el8.x86_64]$ ls -a | + | |
| - | . certs configs | + | |
| - | .. | + | |
| - | arch | + | |
| - | block .config | + | |
| - | </ | + | |
| - | Consultez ce fichier : | + | rsyslog est configuré par le fichier |
| < | < | ||
| - | [trainee@centos8 | + | [root@centos8 |
| - | # | + | # rsyslog configuration file |
| - | # Automatically generated file; DO NOT EDIT. | + | |
| - | # Linux/x86 4.18.0 Kernel Configuration | + | |
| - | # | + | |
| - | # | + | # For more information see / |
| - | # Compiler: gcc (GCC) 8.4.1 20200928 (Red Hat 8.4.1-1) | + | # or latest version online at http://www.rsyslog.com/ |
| - | # | + | # If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html |
| - | CONFIG_64BIT=y | + | |
| - | CONFIG_X86_64=y | + | |
| - | CONFIG_X86=y | + | |
| - | CONFIG_INSTRUCTION_DECODER=y | + | |
| - | CONFIG_OUTPUT_FORMAT=" | + | |
| - | CONFIG_ARCH_DEFCONFIG=" | + | |
| - | CONFIG_LOCKDEP_SUPPORT=y | + | |
| - | CONFIG_STACKTRACE_SUPPORT=y | + | |
| - | CONFIG_MMU=y | + | |
| - | CONFIG_ARCH_MMAP_RND_BITS_MIN=28 | + | |
| - | CONFIG_ARCH_MMAP_RND_BITS_MAX=32 | + | |
| - | CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8 | + | |
| - | CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16 | + | |
| - | CONFIG_GENERIC_ISA_DMA=y | + | |
| - | CONFIG_GENERIC_BUG=y | + | |
| - | CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y | + | |
| - | CONFIG_GENERIC_HWEIGHT=y | + | |
| - | CONFIG_ARCH_MAY_HAVE_PC_FDC=y | + | |
| - | CONFIG_GENERIC_CALIBRATE_DELAY=y | + | |
| - | CONFIG_ARCH_HAS_CPU_RELAX=y | + | |
| - | CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y | + | |
| - | CONFIG_ARCH_HAS_FILTER_PGPROT=y | + | |
| - | CONFIG_HAVE_SETUP_PER_CPU_AREA=y | + | |
| - | CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y | + | |
| - | CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y | + | |
| - | CONFIG_ARCH_HIBERNATION_POSSIBLE=y | + | |
| - | CONFIG_ARCH_SUSPEND_POSSIBLE=y | + | |
| - | CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y | + | |
| - | CONFIG_ARCH_WANT_GENERAL_HUGETLB=y | + | |
| - | CONFIG_ZONE_DMA32=y | + | |
| - | CONFIG_AUDIT_ARCH=y | + | |
| - | CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y | + | |
| - | CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y | + | |
| - | CONFIG_HAVE_INTEL_TXT=y | + | |
| - | CONFIG_X86_64_SMP=y | + | |
| - | --More--(0%) | + | |
| - | </code> | + | |
| - | ===Le Fichier Makefile=== | + | #### MODULES #### |
| - | Le fichier **Makefile** contient le nom du noyau et spécifie les informations suivantes : | + | module(load=" |
| + | | ||
| + | # local messages are retrieved through imjournal now. | ||
| + | module(load=" | ||
| + | | ||
| + | # | ||
| + | # | ||
| - | * VERSION, | + | # Provides UDP syslog reception |
| - | * PATCHLEVEL, | + | # for parameters see http:// |
| - | * SUBLEVEL, | + | # |
| - | * EXTRAVERSION. | + | # |
| - | Les trois premières informations sont gérées par **kernel.org** et Linus Torvalds en personne tandis que l' | + | # Provides TCP syslog reception |
| + | # for parameters see http:// | ||
| + | # | ||
| + | # | ||
| - | < | + | #### GLOBAL DIRECTIVES #### |
| - | [trainee@centos8 linux-4.18.0-305.7.1.el8.x86_64]$ more Makefile | + | |
| - | # SPDX-License-Identifier: | + | |
| - | VERSION = 4 | + | |
| - | PATCHLEVEL = 18 | + | |
| - | SUBLEVEL = 0 | + | |
| - | EXTRAVERSION = | + | |
| - | NAME = Merciless Moray | + | |
| - | # | + | # Where to place auxiliary files |
| - | # DRM backport version | + | global(workDirectory="/ |
| - | # | + | |
| - | RHEL_DRM_VERSION = 5 | + | |
| - | RHEL_DRM_PATCHLEVEL = 9 | + | |
| - | RHEL_DRM_SUBLEVEL | + | |
| - | # *DOCUMENTATION* | + | # Use default timestamp format |
| - | # To see a list of typical targets execute | + | module(load="builtin: |
| - | # More info can be located in ./README | + | |
| - | # Comments in this file are targeted only to the developer, do not | + | |
| - | # expect to learn how to build the kernel reading this file. | + | |
| - | # That's our default target when none is given on the command line | + | # Include all config files in / |
| - | PHONY := _all | + | include(file="/ |
| - | _all: | + | |
| - | # o Do not use make's built-in rules and variables | + | #### RULES #### |
| - | # (this increases performance and avoids hard-to-debug behaviour); | + | |
| - | # o Look for make include files relative to root of kernel src | + | |
| - | MAKEFLAGS += -rR --include-dir=$(CURDIR) | + | |
| - | # Avoid funny character set dependencies | + | # Log all kernel messages to the console. |
| - | unexport LC_ALL | + | # Logging much else clutters up the screen. |
| - | LC_COLLATE=C | + | # |
| - | LC_NUMERIC=C | + | |
| - | export LC_COLLATE LC_NUMERIC | + | |
| - | # Avoid interference with shell env settings | + | # Log anything (except mail) of level info or higher. |
| - | unexport GREP_OPTIONS | + | # Don't log private authentication messages! |
| + | *.info; | ||
| - | # Set RHEL variables | + | # The authpriv file has restricted access. |
| - | # Use this spot to avoid future merge conflicts | + | authpriv.* / |
| - | include Makefile.rhelver | + | |
| - | # We are using a recursive build, so we need to do a little thinking | + | # Log all the mail messages in one place. |
| - | --Plus--(2%) | + | mail.* |
| - | </code> | + | |
| - | <WRAP center round important 60%> | ||
| - | **Important** - La version 2.6 du noyau a vu le jour en **2003**. Les **SUBLEVEL** se suivaient régulièrement. Avec la version 2.6 du noyau, la valeur paire du **PATCHLEVEL** indiquait que le noyau était stable. Quand vous recompilez le noyau à partir des sources, vous devez modifier la valeur de l' | ||
| - | </ | ||
| - | ====2.4 - Paramétrage du noyau==== | + | # Log cron stuff |
| + | cron.* / | ||
| - | Insérez la sortie de la commande | + | # Everybody gets emergency messages |
| + | *.emerg :omusrmsg:* | ||
| - | < | + | # Save news errors of level crit and higher in a special |
| - | [trainee@centos8 linux-4.18.0-305.7.1.el8.x86_64]$ uname -i | + | uucp, |
| - | x86_64 | + | |
| - | [trainee@centos8 linux-4.18.0-305.7.1.el8.x86_64]$ vi .config | + | |
| - | [trainee@centos8 linux-4.18.0-305.7.1.el8.x86_64]$ head .config | + | |
| - | # x86_64 | + | |
| - | # | + | |
| - | # Automatically generated | + | |
| - | # Linux/x86 4.18.0 Kernel Configuration | + | |
| - | # | + | |
| - | # | + | # Save boot messages also to boot.log |
| - | # Compiler: gcc (GCC) 8.4.1 20200928 (Red Hat 8.4.1-1) | + | local7.* / |
| - | # | + | |
| - | CONFIG_64BIT=y | + | |
| - | </ | + | |
| - | Renommez le fichier .config en le plaçant dans le répertoire **~/ | ||
| - | < | + | # ### sample forwarding rule ### |
| - | [trainee@centos8 linux-4.18.0-305.7.1.el8.x86_64]$ cp .config ~/ | + | # |
| - | [trainee@centos8 linux-4.18.0-305.7.1.el8.x86_64]$ ls ~/ | + | # An on-disk queue is created for this action. If the remote host is |
| - | centos-ca-secureboot.der cpupower.config | + | # down, messages are spooled to disk and sent when it is up again. |
| - | centos-dup.x509 | + | #queue.filename=" |
| - | centos-kpatch.x509 debrand-rh-i686-cpu.patch | + | #queue.maxdiskspace=" |
| - | centos.pem | + | #queue.saveonshutdown=" |
| - | centossecureboot001.der | + | #queue.type=" |
| - | centossecureboot201.der | + | #action.resumeRetryCount=" |
| - | centossecurebootca2.der | + | # Remote Logging (we use TCP for reliable delivery) |
| - | check-kabi | + | # remote_host is: name/ip, e.g. 192.168.0.1, port optional e.g. 10514 |
| - | config-x86_64-generic | + | # |
| </ | </ | ||
| - | Copiez le contenu du répertoire **configs** vers le répertoire **~/ | + | Ce fichier est divisé en 3 parties |
| - | < | + | * **Modules**, |
| - | [trainee@centos8 linux-4.18.0-305.7.1.el8.x86_64]$ cp configs/* ~/rpmbuild/SOURCES/ | + | * Section traitant le chargement des modules offrant des fonctionnalités étendues à rsyslog, |
| - | </code> | + | * **Directives Globales** (//Global Directives//), |
| + | * Section traitant les options de comportement global du service rsyslog, | ||
| + | * **Règles** (// | ||
| + | * Section traitant les règles de configuration des journaux. Les règles au format syslogd gardent le même format. Les nouvelles règles, compatibles seulement avec rsyslog commencent par **module**. | ||
| - | Editez la directive **buildid** dans le fichier **~/ | + | ===Modules=== |
| - | < | + | Depuis la version 3 de rsyslog, la réception des données par ce dernier appelée les **inputs** est gérée par l' |
| - | [trainee@centos8 linux-4.18.0-305.7.1.el8.x86_64]$ cd ~/ | + | |
| - | [trainee@centos8 SPECS]$ vi kernel.spec | + | ^ Module ^ Fonction ^ |
| + | | module(load=" | ||
| + | | module(load=" | ||
| + | | module(load=" | ||
| + | | module(load=" | ||
| + | | module(load=" | ||
| + | | module(load=" | ||
| - | [trainee@centos8 SPECS]$ head -n 50 kernel.spec | + | Dans le fichier **/ |
| - | # We have to override the new %%install behavior because, well... the kernel is special. | + | |
| - | %global __spec_install_pre %{___build_pre} | + | |
| - | # At the time of this writing (2019-03), RHEL8 packages use w2.xzdio | + | < |
| - | # compression for rpms (xz, level 2). | + | ... |
| - | # Kernel has several large (hundreds of mbytes) rpms, they take ~5 mins | + | #### MODULES #### |
| - | # to compress by single-threaded xz. Switch to threaded compression, | + | |
| - | # and from level 2 to 3 to keep compressed sizes close to " | + | |
| - | # | + | |
| - | # NB: if default compression in / | + | |
| - | # this one might need tweaking (e.g. if default changes to w3.xzdio, | + | |
| - | # change below to w4T.xzdio): | + | |
| - | %define _binary_payload w3T.xzdio | + | |
| - | # For a kernel released | + | module(load=" |
| - | # For internal testing builds during development, | + | SysSock.Use=" |
| - | %global released_kernel 1 | + | # local messages are retrieved through imjournal now. |
| + | module(load=" | ||
| + | | ||
| + | # | ||
| + | # | ||
| - | %global distro_build 305 | + | # Provides UDP syslog reception |
| + | # for parameters see http:// | ||
| + | # | ||
| + | # | ||
| - | # Sign the x86_64 kernel for secure boot authentication | + | # Provides TCP syslog reception |
| - | %ifarch x86_64 aarch64 | + | # for parameters see http:// |
| - | %global signkernel 1 | + | # |
| - | %else | + | # |
| - | %global signkernel 0 | + | ... |
| - | %endif | + | </ |
| - | # Sign modules | + | Pour activer la réception de messages à partir de serveurs rsyslog distants en utilisant le protocole **UDP**, il convient de décommenter les directives de chargement de modules |
| - | %global signmodules 1 | + | |
| - | # Compress modules only for architectures that build modules | + | < |
| - | %ifarch noarch | + | ... |
| - | %global zipmodules 0 | + | # Provides UDP syslog reception |
| - | %else | + | # for parameters see http:// |
| - | %global zipmodules 1 | + | module(load=" |
| - | %endif | + | input(type=" |
| - | %if %{zipmodules} | + | # Provides TCP syslog reception |
| - | %global zipsed -e 's/\.ko$/\.ko.xz/' | + | # for parameters see http://www.rsyslog.com/doc/ |
| - | %endif | + | module(load=" |
| + | input(type=" | ||
| + | ... | ||
| + | </ | ||
| - | %define buildid | + | <WRAP center round important 60%> |
| + | **Important** : Les deux directives **module(load=" | ||
| + | </ | ||
| - | %define rpmversion 4.18.0 | + | Pour envoyer l' |
| - | %define pkgrelease 305.7.1.el8_4 | + | |
| - | # allow pkg_release | + | < |
| - | %define specrelease 305.7.1%{?dist} | + | ... |
| + | # ### sample forwarding rule ### | ||
| + | # | ||
| + | # An on-disk queue is created for this action. If the remote host is | ||
| + | # down, messages are spooled | ||
| + | #queue.filename=" | ||
| + | #queue.maxdiskspace=" | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # Remote Logging (we use TCP for reliable delivery) | ||
| + | # remote_host is: name/ip, e.g. 192.168.0.1, | ||
| + | Target=" | ||
| + | ... | ||
| + | </ | ||
| - | %define pkg_release %{specrelease}%{? | + | <WRAP center round important 60%> |
| - | </code> | + | **Important** : Ces directives utilisent le protocole TCP. Le serveur distant doit donc être configuré pour ce mode de communication. La directive **Target=" |
| + | </WRAP> | ||
| - | ====2.5 - Compiler le Noyau==== | + | ===Directives Globales=== |
| - | La compilation du noyau peut prendre beaucoup | + | Les directives dans cette section servent à configurer le comportement |
| - | <code> | + | <file> |
| - | [trainee@centos7 SPECS]$ rpmbuild -bb --target=`uname -m` kernel.spec 2> build-err.log | tee build-out.log & | + | module(load=" |
| - | </code> | + | </file> |
| - | <WRAP center round important 60%> | + | Cette directive stipule que le format des entrées dans les fichiers de journalisation |
| - | **Important** - La compilation peut prendre des heures. Arrêtez donc le processus avec les touches ^C. Arrêtez ensuite votre VM. Demandez à votre formateur | + | |
| - | </ | + | |
| - | A l'issu du processus, les RPMs se trouvent dans le répertoire **/ | + | ===Règles=== |
| - | < | + | Chaque règle prend la forme suivante |
| - | ... | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Wrote: / | + | |
| - | Executing(%clean): | + | |
| - | [1]+ Done rpmbuild | + | < |
| - | </code> | + | Sélecteur[; ...] |
| + | </file> | ||
| - | < | + | Un Sélecteur est défini d'une des façons suivantes : |
| - | [trainee@centos8 SPECS]$ cd ../RPMS | + | |
| - | [trainee@centos8 RPMS]$ ls | + | |
| - | x86_64 | + | |
| - | [trainee@centos8 RPMS]$ cd x86_64/ | + | |
| - | [trainee@centos8 x86_64]$ ls | + | |
| - | bpftool-4.18.0-305.7.1.el8.i2tch.x86_64.rpm | + | |
| - | bpftool-debuginfo-4.18.0-305.7.1.el8.i2tch.x86_64.rpm | + | |
| - | kernel-4.18.0-305.7.1.el8.i2tch.x86_64.rpm | + | |
| - | kernel-core-4.18.0-305.7.1.el8.i2tch.x86_64.rpm | + | |
| - | kernel-cross-headers-4.18.0-305.7.1.el8.i2tch.x86_64.rpm | + | |
| - | kernel-debug-4.18.0-305.7.1.el8.i2tch.x86_64.rpm | + | |
| - | kernel-debug-core-4.18.0-305.7.1.el8.i2tch.x86_64.rpm | + | |
| - | kernel-debug-debuginfo-4.18.0-305.7.1.el8.i2tch.x86_64.rpm | + | |
| - | kernel-debug-devel-4.18.0-305.7.1.el8.i2tch.x86_64.rpm | + | |
| - | kernel-debuginfo-4.18.0-305.7.1.el8.i2tch.x86_64.rpm | + | |
| - | </ | + | |
| - | Notez que la génération du nouveau noyau peut consommer jusqu' | + | ==Sous-système applicatif.Priorité== |
| - | < | + | Dans ce cas on ne tient compte que des messages de priorité égale ou supérieure à la Priorité indiquée. |
| - | [trainee@centos8 x86_64]$ df -h | + | |
| - | Filesystem | + | |
| - | devtmpfs | + | |
| - | tmpfs 1.9G | + | |
| - | tmpfs 1.9G 9.4M 1.9G 1% /run | + | |
| - | tmpfs 1.9G | + | |
| - | / | + | |
| - | / | + | |
| - | tmpfs 374M | + | |
| - | tmpfs 374M 1.2M 373M 1% / | + | |
| - | / | + | |
| - | </ | + | |
| - | ====2.6 - Installer le Nouveau Noyau==== | + | ==Sous-système applicatif!Priorité== |
| - | Installez maintenant les paquets **kernel***. L' | + | Dans ce cas on ne tient compte que des messages |
| - | < | + | ==Sous-système applicatif=Priorité== |
| - | [root@centos8 x86_64]# dnf localinstall kernel-*.rpm | + | |
| - | Last metadata expiration check: 2:25:32 ago on Tue 20 Jul 2021 08:37:00 EDT. | + | |
| - | Dependencies resolved. | + | |
| - | =============================================================================================================================================================================================================== | + | |
| - | | + | |
| - | =============================================================================================================================================================================================================== | + | |
| - | Installing: | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Downgrading: | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| - | Transaction Summary | + | Dans ce cas on ne tient compte que des messages de priorité égale à la Priorité indiquée. |
| - | =============================================================================================================================================================================================================== | + | |
| - | Install | + | |
| - | Downgrade | + | |
| - | Total size: 1.6 G | + | ==L' |
| - | Is this ok [y/N]: y | + | |
| - | </ | + | |
| - | A l' | + | La valeur du Sous-système applicatif et/ou de la Priorité peut également être *****. Dans ce cas, toutes les valeurs possibles du **Sous-système applicatif** et/ou de la **Priorité** sont concernées, |
| - | < | + | ==n Sous-systèmes avec la même priorité== |
| - | [root@centos7 ~]# reboot | + | |
| - | </ | + | |
| - | Connectez-vous en tant que trainee et devenez root. Listez ensuite | + | Plusieurs Sous-systèmes applicatifs peuvent être stipulés pour la même Priorité |
| - | < | + | ==n Sélecteurs avec la même Action== |
| - | [root@centos8 ~]# rpm -qa | grep kernel | + | |
| - | kernel-modules-4.18.0-305.3.1.el8.x86_64 | + | |
| - | kernel-tools-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-headers-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-debuginfo-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-debug-core-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-modules-internal-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-modules-4.18.0-305.7.1.el8_4.x86_64 | + | |
| - | kernel-debug-modules-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-devel-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-tools-debuginfo-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-tools-libs-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-debug-modules-internal-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-cross-headers-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-core-4.18.0-305.7.1.el8_4.x86_64 | + | |
| - | kernel-devel-4.18.0-305.7.1.el8_4.x86_64 | + | |
| - | kernel-debuginfo-common-x86_64-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-debug-modules-extra-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-debug-devel-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-tools-libs-devel-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-modules-extra-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-4.18.0-305.7.1.el8_4.x86_64 | + | |
| - | kernel-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-core-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-selftests-internal-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-debug-debuginfo-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-debug-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-4.18.0-305.3.1.el8.x86_64 | + | |
| - | kernel-core-4.18.0-305.3.1.el8.x86_64 | + | |
| - | kernel-modules-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | kernel-ipaclones-internal-4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | </ | + | |
| - | Constatez l'entrée | + | Une Action peut s'appliquer à plusieurs Sélecteurs en les séparant par le caractère |
| - | < | ||
| - | [root@centos8 ~]# grep i2tch / | ||
| - | saved_entry=95bd69e34a7444a7b58cb74fbfb86df2-4.18.0-305.7.1.el8.i2tch.x86_64 | ||
| - | </ | ||
| - | Dernièrement, | + | <WRAP center round important 60%> |
| + | **Important** : Une Action précédée par le signe **-** est entreprise d'une manière **asynchrone**. Dans le cas ou l'action est entreprise d'une manière **synchrone**, | ||
| + | </ | ||
| - | < | + | =====LAB |
| - | [root@centos8 ~]# uname -r | + | |
| - | 4.18.0-305.7.1.el8.i2tch.x86_64 | + | |
| - | </ | + | |
| - | =====LAB #3 - Gestion | + | La commande **/ |
| - | Sous Linux il est possible de mettre en place des quotas par utilisateur et par groupe. Ceci étant, Linux ne sait pas gérer des quotas par répertoire, | + | La syntaxe de la commande |
| - | quotas par partition. L' | + | |
| - | Déconnectez-vous et reconnectez-vous **directement** en tant que root : | + | < |
| + | logger | ||
| + | </ | ||
| + | |||
| + | Par exemple saisissez la commande suivante | ||
| < | < | ||
| - | root@computeXX: | + | [root@centos8 ~]# logger -p user.info Linux est super |
| - | root@10.0.2.45' | + | |
| - | Activate the web console with: systemctl enable --now cockpit.socket | + | |
| - | + | ||
| - | Last login: Wed Jul 21 11:14:31 2021 | + | |
| - | [root@centos8 ~]# | + | |
| </ | </ | ||
| - | Avant de mettre en place des quotas, configurer SELINUX en mode **permissive** afin de ne pas avoir d' | + | Consultez la fin de votre syslog |
| < | < | ||
| - | [root@centos8 ~]# getenforce | + | [root@centos8 ~]# tail / |
| - | Enforcing | + | Jun 3 12:55:01 centos8 systemd[1]: session-237.scope: |
| - | [root@centos8 | + | Jun 3 12:56:01 centos8 systemd[1]: Started Session 238 of user trainee. |
| - | [root@centos8 | + | Jun 3 12: |
| - | Permissive | + | Jun 3 12:57:01 centos8 systemd[1]: Started Session 239 of user trainee. |
| - | [root@centos8 | + | Jun 3 12: |
| + | Jun 3 12:58:01 centos8 systemd[1]: Started Session 240 of user trainee. | ||
| + | Jun 3 12:58:01 centos8 systemd[1]: session-240.scope: | ||
| + | Jun 3 12: | ||
| + | Jun 3 12:59:01 centos8 systemd[1]: Started Session 241 of user trainee. | ||
| + | Jun 3 12:59:01 centos8 systemd[1]: session-241.scope: | ||
| </ | </ | ||
| - | Editez ensuite le fichier / | + | Les options de la commande logger sont : |
| < | < | ||
| - | [root@centos8 ~]# vi / | + | [root@centos8 ~]# logger --help |
| - | [root@centos8 ~]# cat / | + | |
| - | # This file controls the state of SELinux on the system. | + | Usage: |
| - | # SELINUX= can take one of these three values: | + | logger [options] [< |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | SELINUX=permissive | + | |
| - | # SELINUXTYPE= can take one of these three values: | + | |
| - | # | + | |
| - | # | + | |
| - | # mls - Multi Level Security protection. | + | |
| - | SELINUXTYPE=targeted | + | |
| - | </ | + | Enter messages into the system log. |
| - | Commencez par vérifiez que le paquet **quota** est bien installé | + | Options: |
| + | | ||
| + | | ||
| + | -f, --file < | ||
| + | -e, --skip-empty | ||
| + | | ||
| + | -p, --priority < | ||
| + | | ||
| + | | ||
| + | -s, --stderr | ||
| + | -S, --size < | ||
| + | -t, --tag < | ||
| + | -n, --server < | ||
| + | -P, --port < | ||
| + | -T, --tcp use TCP only | ||
| + | -d, --udp use UDP only | ||
| + | | ||
| + | | ||
| + | < | ||
| + | | ||
| + | | ||
| + | | ||
| + | -u, --socket < | ||
| + | | ||
| + | print connection errors when using Unix sockets | ||
| + | | ||
| - | < | + | -h, --help |
| - | [root@centos8 ~]# rpm -qa | grep quota | + | -V, --version |
| - | quota-4.04-12.el8.x86_64 | + | |
| - | quota-nls-4.04-12.el8.noarch | + | For more details see logger(1). |
| </ | </ | ||
| - | Editez le fichier | + | =====LAB #4 - La Commande logrotate===== |
| + | |||
| + | Les fichiers journaux grossissent régulièrement. Le programme | ||
| + | |||
| + | Visualisez le fichier | ||
| < | < | ||
| - | [root@centos8 ~]# vi /etc/fstab | + | [root@centos8 ~]# cat /etc/logrotate.conf |
| - | [root@centos8 ~]# cat /etc/fstab | + | # see "man logrotate" |
| + | # rotate log files weekly | ||
| + | weekly | ||
| - | # | + | # keep 4 weeks worth of backlogs |
| - | # / | + | rotate 4 |
| - | # Created by anaconda on Wed Jun 16 06:21:32 2021 | + | |
| - | # | + | |
| - | # Accessible filesystems, | + | |
| - | # See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info. | + | |
| - | # | + | |
| - | # After editing this file, run ' | + | |
| - | # units generated from this file. | + | |
| - | # | + | |
| - | / | + | |
| - | UUID=1c04981e-5317-4b73-9695-3ce25246835d /boot | + | |
| - | / | + | |
| - | UUID=f76d6b66-985b-4a91-af9c-4987e8c1443c /home | + | |
| - | </ | + | |
| - | Redémarrez la VM : | + | # create new (empty) log files after rotating old ones |
| + | create | ||
| - | < | + | # use date as a suffix of the rotated file |
| - | [root@centos8 ~]# reboot | + | dateext |
| - | </ | + | |
| - | Reconnectez-vous **directement** en tant que root : | + | # uncomment this if you want your log files compressed |
| + | #compress | ||
| - | < | + | # RPM packages drop log rotation information into this directory |
| - | root@computeXX: | + | include / |
| - | root@10.0.2.45' | + | |
| - | Activate the web console with: systemctl enable --now cockpit.socket | + | |
| - | Last login: Wed Jul 21 11:19:46 2021 | + | # system-specific logs may be also be configured here. |
| - | [root@centos8 ~]# | + | |
| </ | </ | ||
| - | Vérifiez ensuite que les options **usrquota** et **grpquota** soient prises en compte | + | Dans la première partie de ce fichier on trouve des directives pour : |
| - | < | + | * remplacer les fichiers journaux chaque semaine |
| - | [root@centos8 ~]# cat /etc/mtab | grep /home | + | * garder 4 archives des fichiers journaux |
| - | /dev/sdc1 /home ext4 rw, | + | * créer un nouveau fichier log une fois le précédent archivé |
| - | </ | + | * comprimer les archives créées. |
| - | ====3.1 - La Commande quotacheck==== | + | La directive **include / |
| - | Pour activer les quotas sur /home, il convient d' | + | La deuxième partie du fichier concerne des configurations spécifiques pour certains fichiers journaux. |
| - | <code> | + | <WRAP center round important 60%> |
| - | [root@centos8 ~]# quotacheck -cugvm -f /dev/sdc1 | + | **Important** |
| - | quotacheck: Your kernel probably supports journaled quota but you are not using it. Consider switching to journaled quota to avoid running quotacheck after an unclean shutdown. | + | </WRAP> |
| - | quotacheck: Scanning /dev/sdc1 [/home] done | + | |
| - | quotacheck: Cannot stat old user quota file / | + | |
| - | quotacheck: Cannot stat old group quota file / | + | |
| - | quotacheck: Cannot stat old user quota file / | + | |
| - | quotacheck: Cannot stat old group quota file / | + | |
| - | quotacheck: Checked 6763 directories and 129772 files | + | |
| - | quotacheck: Old file not found. | + | |
| - | quotacheck: Old file not found. | + | |
| - | </code> | + | |
| - | Les options de la commande | + | Les options de la commande |
| < | < | ||
| - | [root@centos8 ~]# quotacheck | + | [root@centos8 ~]# logrotate |
| - | Utility for checking and repairing quota files. | + | Usage: logrotate [OPTION...] < |
| - | quotacheck [-gucbfinvdmMR] [-F <quota-format>] filesystem|-a | + | -d, --debug |
| + | messages | ||
| + | -f, --force | ||
| + | -m, --mail=command | ||
| + | -s, --state=statefile | ||
| + | -v, --verbose | ||
| + | -l, --log=logfile | ||
| + | --version | ||
| - | -u, --user | + | Help options: |
| - | -g, --group | + | -?, --help |
| - | -c, --create-files | + | --usage |
| - | -b, --backup | + | |
| - | -f, --force | + | |
| - | -i, --interactive | + | |
| - | -n, --use-first-dquot | + | |
| - | -v, --verbose | + | |
| - | -d, --debug | + | |
| - | -m, --no-remount | + | |
| - | -M, --try-remount | + | |
| - | continue even if it fails | + | |
| - | -R, --exclude-root | + | |
| - | -F, --format=formatname | + | |
| - | -a, --all check all filesystems | + | |
| - | -h, --help | + | |
| - | -V, --version | + | |
| - | + | ||
| - | Bugs to jack@suse.cz | + | |
| </ | </ | ||
| - | Les quotas ont été activés et les fichier **aquota.user** et **aquota.group** ont été créés dans le répertoire /home : | + | =====LAB #5 - La Journalisation avec journald===== |
| - | < | + | Sous RHEL/CentOS 8, les fichiers de Syslog sont gardés pour une question de compatibilité. Cependant, tous les journaux sont d' |
| - | [root@centos8 ~]# ls -la /home | + | |
| - | total 40 | + | |
| - | drwxr-xr-x. 4 root root 4096 Jul 21 11:27 . | + | |
| - | dr-xr-xr-x. 17 root root 224 Jul 19 12:05 .. | + | |
| - | -rw-------. | + | |
| - | -rw-------. | + | |
| - | drwx------. | + | |
| - | drwxr-xr-x. 17 trainee trainee | + | |
| - | </ | + | |
| - | + | ||
| - | Créez maintenant un utilisateur | + | |
| < | < | ||
| - | [root@centos8 ~]# groupadd fenestros && useradd fenestros | + | [root@centos8 ~]# ls -l /run/log/journal/ |
| - | [root@centos8 ~]# passwd fenestros | + | total 0 |
| - | Changing password for user fenestros. | + | drwxr-s---+ 2 root systemd-journal 60 Jun 3 09:01 de79af4f226d480fa7d3fec4cabbf97a |
| - | New password: | + | |
| - | BAD PASSWORD: The password contains the user name in some form | + | |
| - | Retype new password: | + | |
| - | passwd: all authentication tokens updated successfully. | + | |
| </ | </ | ||
| - | ====3.2 - La Commande edquota==== | + | A l' |
| - | Mettez en place maintenant un quota de 10Mo pour l' | + | Pour rendre les journaux permenants, il faut créer le répertoire |
| < | < | ||
| - | [root@centos8 ~]# edquota | + | [root@centos8 ~]# mkdir / |
| + | [root@centos8 ~]# ls -l / | ||
| + | total 0 | ||
| + | [root@centos8 ~]# systemctl restart systemd-journald | ||
| + | [root@centos8 ~]# ls -l /run/ | ||
| + | ls: cannot access '/ | ||
| + | [root@centos8 ~]# ls -l / | ||
| + | total 0 | ||
| + | drwxr-xr-x. 2 root root 28 Jun 3 13:03 de79af4f226d480fa7d3fec4cabbf97a | ||
| </ | </ | ||
| - | L' | + | Journald ne peut pas envoyer les traces à un autre ordinateur. Pour utiliser un serveur de journalisation distant il faut donc inclure la directive |
| - | <file> | + | <code> |
| - | Disk quotas for user fenestros (uid 1001): | + | [root@centos8 ~]# cat / |
| - | | + | # This file is part of systemd. |
| - | /dev/ | + | # |
| - | </file> | + | # systemd is free software; you can redistribute it and/or modify it |
| + | # under the terms of the GNU Lesser General Public License as published by | ||
| + | # the Free Software Foundation; either version 2.1 of the License, or | ||
| + | # (at your option) any later version. | ||
| + | # | ||
| + | # Entries in this file show the compile time defaults. | ||
| + | # You can change settings by editing this file. | ||
| + | # Defaults can be restored by simply deleting this file. | ||
| + | # | ||
| + | # See journald.conf(5) for details. | ||
| - | Modifiez ce fichier ainsi : | + | [Journal] |
| + | # | ||
| + | # | ||
| + | #Seal=yes | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | ForwardToSyslog=yes | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | </ | ||
| - | < | + | ====5.1 - Consultation des Journaux==== |
| - | Disk quotas for user fenestros (uid 1001): | + | |
| - | Filesystem | + | |
| - | / | + | |
| - | </ | + | |
| - | Sauvegardez et quittez le fichier. | + | L' |
| - | + | ||
| - | Les options | + | |
| < | < | ||
| - | [root@centos8 ~]# edquota | + | [root@centos8 ~]# journalctl |
| - | edquota: Usage: | + | -- Logs begin at Thu 2021-06-03 09:01:10 EDT, end at Thu 2021-06-03 13:08:01 EDT. -- |
| - | edquota [-rm] [-u] [-F formatname] [-p username] [-f filesystem] username | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: Linux version 4.18.0-240.22.1.el8_3.x86_64 (mockbuild@kbuilder.bsys.centos.org) (gcc version 8.3.1 20191121 (Red Hat 8.3.1-5) (GCC)) #1 SMP Thu Apr 8 19:01:30 UTC 2021 |
| - | | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: Command line: BOOT_IMAGE=(hd0, |
| - | | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' |
| - | edquota | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' |
| - | | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' |
| - | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256 | |
| - | -u, --user | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using ' |
| - | -g, --group | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-provided physical RAM map: |
| - | -P, --project | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable |
| - | -r, --remote | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: |
| - | -m, --no-mixed-pathnames | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: |
| - | -F, --format=formatname | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: |
| - | -p, --prototype=name | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: |
| - | | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: |
| - | | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: |
| - | -f, --filesystem=filesystem | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: |
| - | -t, --edit-period | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: |
| - | -T, --edit-times | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: NX (Execute Disable) protection: active |
| - | -h, --help | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: SMBIOS 2.5 present. |
| - | -V, --version | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: DMI: innotek GmbH VirtualBox/ |
| - | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: Hypervisor detected: KVM | |
| - | Bugs to: jack@suse.cz | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: kvm-clock: Using msrs 4b564d01 and 4b564d00 |
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: kvm-clock: cpu 0, msr 114801001, primary cpu clock | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: kvm-clock: using sched offset of 5675771878 cycles | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: clocksource: | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: tsc: Detected 1190.400 MHz processor | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: e820: update [mem 0x00000000-0x00000fff] usable ==> reserved | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: e820: remove [mem 0x000a0000-0x000fffff] usable | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: last_pfn = 0x120000 max_arch_pfn = 0x400000000 | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: MTRR default type: uncachable | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: MTRR variable ranges disabled: | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: Disabled | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: x86/PAT: MTRRs disabled, skipping PAT initialization too. | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: CPU MTRRs all blank - virtualized system. | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: x86/PAT: Configuration [0-7]: WB WT UC- UC WB WT UC- UC | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: last_pfn = 0xdfff0 max_arch_pfn = 0x400000000 | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: found SMP MP-table at [mem 0x0009fff0-0x0009ffff] | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: kexec: Reserving the low 1M of memory for crashkernel | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BRK [0x114a01000, 0x114a01fff] PGTABLE | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BRK [0x114a02000, 0x114a02fff] PGTABLE | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BRK [0x114a03000, | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BRK [0x114a04000, 0x114a04fff] PGTABLE | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BRK [0x114a05000, 0x114a05fff] PGTABLE | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BRK [0x114a06000, 0x114a06fff] PGTABLE | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BRK [0x114a07000, 0x114a07fff] PGTABLE | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BRK [0x114a08000, 0x114a08fff] PGTABLE | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BRK [0x114a09000, | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: RAMDISK: [mem 0x34e00000-0x366f7fff] | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: ACPI: Early table checksum verification disabled | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: ACPI: RSDP 0x00000000000E0000 000024 (v02 VBOX ) | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: ACPI: XSDT 0x00000000DFFF0030 00003C (v01 VBOX | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: ACPI: FACP 0x00000000DFFF00F0 0000F4 (v04 VBOX | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: ACPI: DSDT 0x00000000DFFF0480 002325 (v02 VBOX | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: ACPI: FACS 0x00000000DFFF0200 000040 | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: ACPI: FACS 0x00000000DFFF0200 000040 | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: ACPI: APIC 0x00000000DFFF0240 00006C (v02 VBOX | ||
| + | lines 1-57 | ||
| </ | </ | ||
| <WRAP center round important 60%> | <WRAP center round important 60%> | ||
| - | **Important** | + | **Important** |
| </ | </ | ||
| - | ====3.3 - La Commande quotaon==== | + | ====5.2 - Consultation des Journaux d'une Application Spécifique==== |
| - | Appliquez maintenant | + | Pour consulter |
| < | < | ||
| - | [root@centos8 ~]# quotaon | + | [root@centos8 ~]# journalctl / |
| + | -- Logs begin at Thu 2021-06-03 09:01:10 EDT, end at Thu 2021-06-03 13:10:01 EDT. -- | ||
| + | Jun 03 10:01:01 centos8.ittraining.loc anacron[2575]: | ||
| + | Jun 03 10:01:01 centos8.ittraining.loc anacron[2575]: | ||
| + | Jun 03 10:01:01 centos8.ittraining.loc anacron[2575]: | ||
| + | Jun 03 10:16:01 centos8.ittraining.loc anacron[2575]: | ||
| + | Jun 03 10:16:01 centos8.ittraining.loc anacron[2575]: | ||
| + | Jun 03 10:16:01 centos8.ittraining.loc anacron[2575]: | ||
| </ | </ | ||
| - | |||
| - | Les options de la commande **quotaon** sont : | ||
| - | |||
| - | < | ||
| - | [root@centos8 ~]# quotaon --help | ||
| - | quotaon: Usage: | ||
| - | quotaon [-guPvp] [-F quotaformat] [-x state] -a | ||
| - | quotaon [-guPvp] [-F quotaformat] [-x state] filesys ... | ||
| - | |||
| - | -a, --all turn quotas on for all filesystems | ||
| - | -f, --off turn quotas off | ||
| - | -u, --user | ||
| - | -g, --group | ||
| - | -P, --project | ||
| - | -p, --print-state | ||
| - | -x, --xfs-command=cmd | ||
| - | -F, --format=formatname | ||
| - | -v, --verbose | ||
| - | -h, --help | ||
| - | -V, --version | ||
| - | </ | ||
| - | |||
| - | De cette manière vous avez mis en place un quota **souple** pour fenestros de 8 000 Ko et un quota **stricte** de 10 000 Ko. | ||
| - | |||
| - | Quand l' | ||
| - | |||
| - | Il est à noter que vous pouvez soit mettre en place un quota en taille, soit mettre en place un quota basé sur le nombre d' | ||
| <WRAP center round important 60%> | <WRAP center round important 60%> | ||
| - | **important** - La commande pour désactivez les quotas | + | **Important** : Rappelez-vous que sous RHEL/CentOS 8 le répertoire **/ |
| </ | </ | ||
| - | ====3.4 - La Commande repquota==== | + | ====5.3 - Consultation des Journaux depuis le Dernier Démarrage==== |
| - | Pour visualiser | + | Pour consulter |
| < | < | ||
| - | [root@centos8 ~]# repquota /home | + | [root@centos8 ~]# journalctl -b | more |
| - | *** Report for user quotas on device /dev/sdc1 | + | -- Logs begin at Thu 2021-06-03 09:01:10 EDT, end at Thu 2021-06-03 13:11:01 EDT. -- |
| - | Block grace time: 7days; Inode grace time: 7days | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: Linux version 4.18.0-240.22.1.el8_3.x86_64 (mockbuild@kbuilder.bsys.centos.org) (gcc version |
| - | Block limits | + | 8.3.1 20191121 (Red Hat 8.3.1-5) (GCC)) #1 SMP Thu Apr 8 19:01:30 UTC 2021 |
| - | User used soft hard grace used soft hard grace | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: Command line: BOOT_IMAGE=(hd0, |
| - | ---------------------------------------------------------------------- | + | c-0d59-45be-bd73-d292b80be33c ro crashkernel=auto resume=UUID=c8bb3f47-d67f-4b21-b781-766899dc83d4 rhgb quiet |
| - | root | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' |
| - | trainee | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' |
| - | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' | |
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: x86/fpu: xstate_offset[2]: | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using ' | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-provided physical RAM map: | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: [mem 0x0000000000100000-0x00000000dffeffff] usable | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: [mem 0x00000000dfff0000-0x00000000dfffffff] ACPI data | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: [mem 0x00000000fec00000-0x00000000fec00fff] reserved | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: [mem 0x00000000fee00000-0x00000000fee00fff] reserved | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: BIOS-e820: [mem 0x0000000100000000-0x000000011fffffff] usable | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: NX (Execute Disable) protection: active | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: SMBIOS 2.5 present. | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: DMI: innotek GmbH VirtualBox/ | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: Hypervisor detected: KVM | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: kvm-clock: Using msrs 4b564d01 and 4b564d00 | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: kvm-clock: cpu 0, msr 114801001, primary cpu clock | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: kvm-clock: using sched offset of 5675771878 cycles | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: clocksource: | ||
| + | 590591483 ns | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: tsc: Detected 1190.400 MHz processor | ||
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: e820: update [mem 0x00000000-0x00000fff] usable ==> reserved | ||
| + | --More-- | ||
| </ | </ | ||
| <WRAP center round important 60%> | <WRAP center round important 60%> | ||
| - | **Important** | + | **Important** |
| </ | </ | ||
| - | Les options de la commande | + | ====5.4 - Consultation des Journaux d'une Priorité Spécifique==== |
| + | |||
| + | Pour consulter les entrées à partir d'une priorité spécifique et supérieur, il suffit d' | ||
| < | < | ||
| - | [root@centos8 ~]# repquota | + | [root@centos8 ~]# journalctl -p warning |
| - | repquota: Utility for reporting quotas. | + | -- Logs begin at Thu 2021-06-03 09:01:10 EDT, end at Thu 2021-06-03 13:12:01 EDT. -- |
| - | Usage: | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: |
| - | repquota | + | Jun 03 09:01:10 centos8.ittraining.loc kernel: #3 |
| + | Jun 03 09:01:10 centos8.ittraining.loc kernel: acpi PNP0A03:00: fail to add MMCONFIG information, | ||
| + | Jun 03 09:01:12 centos8.ittraining.loc kernel: e1000: E1000 MODULE IS NOT SUPPORTED | ||
| + | Jun 03 09:01:12 centos8.ittraining.loc kernel: | ||
| + | Jun 03 09:01:12 centos8.ittraining.loc kernel: | ||
| + | Jun 03 09:01:18 centos8.ittraining.loc kernel: printk: systemd: 19 output lines suppressed due to ratelimiting | ||
| + | Jun 03 09:01:20 centos8.ittraining.loc firewalld[874]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration> | ||
| + | Jun 03 09:01:21 centos8.ittraining.loc systemd[1]: iscsi.service: | ||
| + | Jun 03 09:01:24 centos8.ittraining.loc systemd[1]: iscsi.service: | ||
| + | Jun 03 09:01:24 centos8.ittraining.loc systemd[1]: iscsi.service: | ||
| + | Jun 03 09:01:26 centos8.ittraining.loc chronyd[850]: | ||
| + | Jun 03 09:01:28 centos8.ittraining.loc chronyd[850]: | ||
| + | Jun 03 12:46:31 centos8.ittraining.loc chronyd[850]: | ||
| + | lines 1-15/15 (END) | ||
| + | </ | ||
| - | -v, --verbose | + | Les priorités reconnues par Journald sont : |
| - | -u, --user | + | |
| - | -g, --group | + | |
| - | -P, --project | + | |
| - | -s, --human-readable | + | |
| - | -t, --truncate-names | + | |
| - | -p, --raw-grace | + | |
| - | -n, --no-names | + | |
| - | -i, --no-autofs | + | |
| - | -c, --cache | + | |
| - | -C, --no-cache | + | |
| - | -F, --format=formatname | + | |
| - | -O, --output=format | + | |
| - | -a, --all | + | |
| - | -h, --help | + | |
| - | -V, --version | + | |
| - | Bugs to jack@suse.cz | + | ^ Niveau ^ Priorité ^ Description ^ |
| - | </ | + | | 0 | emerg | Système inutilisable | |
| + | | 1 | alert | Action immédiate requise | | ||
| + | | 2 | crit | Condition critique atteinte | | ||
| + | | 3 | err | Erreurs rencontrées | | ||
| + | | 4 | warning | Avertissements présentés | | ||
| + | | 5 | notice | Condition normale - message important | | ||
| + | | 6 | info | Condition normale - message simple | | ||
| + | | 7 | debug | Condition normale - message de débogage | | ||
| - | ====3.5 - La Commande quota==== | + | ====5.5 - Consultation des Journaux d'une Plage de Dates ou d' |
| - | Pour visualiser | + | Pour consulter |
| < | < | ||
| - | [root@centos8 ~]# quota fenestros | + | [root@centos8 ~]# journalctl --since 12:00 --until now |
| - | Disk quotas for user fenestros | + | -- Logs begin at Thu 2021-06-03 09:01:10 EDT, end at Thu 2021-06-03 13:14:01 EDT. -- |
| - | [root@centos8 | + | Jun 03 12:00:01 centos8.ittraining.loc systemd[1]: Started Session 181 of user trainee. |
| - | [fenestros@centos8 | + | Jun 03 12:00:01 centos8.ittraining.loc CROND[4238]: |
| - | [fenestros@centos8 | + | Jun 03 12:00:01 centos8.ittraining.loc systemd[1]: session-181.scope: |
| - | logout | + | Jun 03 12:01:01 centos8.ittraining.loc CROND[4251]: (root) CMD (run-parts / |
| - | [root@centos8 | + | Jun 03 12: |
| - | Disk quotas for user fenestros | + | Jun 03 12:01:01 centos8.ittraining.loc run-parts[4255]: |
| - | Filesystem | + | Jun 03 12:01:01 centos8.ittraining.loc CROND[4260]: (trainee) CMD (/bin/pwd > pwd.txt) |
| - | /dev/sdc1 | + | Jun 03 12: |
| + | Jun 03 12:01:01 centos8.ittraining.loc systemd[1]: session-182.scope: | ||
| + | Jun 03 12: | ||
| + | Jun 03 12:02:01 centos8.ittraining.loc CROND[4275]: | ||
| + | Jun 03 12:02:01 centos8.ittraining.loc systemd[1]: session-183.scope: | ||
| + | Jun 03 12: | ||
| + | Jun 03 12:03:01 centos8.ittraining.loc CROND[4289]: | ||
| + | Jun 03 12:03:01 centos8.ittraining.loc systemd[1]: session-184.scope: | ||
| + | Jun 03 12:04:01 centos8.ittraining.loc systemd[1]: Started Session 185 of user trainee. | ||
| + | Jun 03 12:04:01 centos8.ittraining.loc CROND[4303]: | ||
| + | Jun 03 12:04:01 centos8.ittraining.loc systemd[1]: session-185.scope: | ||
| + | Jun 03 12:05:01 centos8.ittraining.loc systemd[1]: Started Session 186 of user trainee. | ||
| + | Jun 03 12:05:01 centos8.ittraining.loc CROND[4319]: | ||
| + | Jun 03 12:05:01 centos8.ittraining.loc systemd[1]: session-186.scope: | ||
| + | Jun 03 12:06:02 centos8.ittraining.loc systemd[1]: Started Session 187 of user trainee. | ||
| + | Jun 03 12:06:02 centos8.ittraining.loc CROND[4332]: | ||
| + | Jun 03 12:06:02 centos8.ittraining.loc systemd[1]: session-187.scope: | ||
| + | Jun 03 12:07:01 centos8.ittraining.loc systemd[1]: Started Session 188 of user trainee. | ||
| + | Jun 03 12:07:01 centos8.ittraining.loc CROND[4346]: | ||
| + | Jun 03 12:07:01 centos8.ittraining.loc systemd[1]: session-188.scope: | ||
| + | Jun 03 12:08:01 centos8.ittraining.loc systemd[1]: Started Session 189 of user trainee. | ||
| + | Jun 03 12:08:01 centos8.ittraining.loc CROND[4360]: | ||
| + | Jun 03 12:08:01 centos8.ittraining.loc systemd[1]: session-189.scope: | ||
| + | lines 1-31 | ||
| </ | </ | ||
| - | Les options de la commande | + | <WRAP center round important 60%> |
| + | **Important** : Il est possible d' | ||
| + | </ | ||
| - | < | + | ====5.6 - Consultation des Journaux en Live==== |
| - | [root@centos8 ~]# quota --help | + | |
| - | quota: Usage: quota [-guPqvswim] [-l | [-Q | -A]] [-F quotaformat] | + | |
| - | quota [-qvswim] [-l | [-Q | -A]] [-F quotaformat] -u username | + | |
| - | quota [-qvswim] [-l | [-Q | -A]] [-F quotaformat] -g groupname ... | + | |
| - | quota [-qvswugPQm] [-F quotaformat] -f filesystem ... | + | |
| - | -u, --user | + | Pour consulter les journaux en live, il suffit d' |
| - | -g, --group | + | |
| - | -P, --project | + | |
| - | -q, --quiet | + | |
| - | -v, --verbose | + | |
| - | -s, --human-readable | + | |
| - | --always-resolve | + | |
| - | composed of only digits | + | |
| - | -w, --no-wrap | + | |
| - | -p, --raw-grace | + | |
| - | -l, --local-only | + | |
| - | -Q, --quiet-refuse | + | |
| - | not respond | + | |
| - | -i, --no-autofs | + | |
| - | -F, --format=formatname | + | |
| - | -f, --filesystem-list | + | |
| - | -A, --all-nfs | + | |
| - | -m, --no-mixed-pathnames | + | |
| - | --show-mntpoint | + | |
| - | --hide-device | + | |
| - | -h, --help | + | |
| - | -V, --version | + | |
| - | Bugs to: jack@suse.cz | + | < |
| + | [root@centos8 ~]# journalctl -f | ||
| + | -- Logs begin at Thu 2021-06-03 09:01:10 EDT. -- | ||
| + | Jun 03 13:13:08 centos8.ittraining.loc systemd[1]: Started dnf makecache. | ||
| + | Jun 03 13:14:01 centos8.ittraining.loc systemd[1]: Started Session 256 of user trainee. | ||
| + | Jun 03 13:14:01 centos8.ittraining.loc CROND[5391]: | ||
| + | Jun 03 13:14:01 centos8.ittraining.loc systemd[1]: session-256.scope: | ||
| + | Jun 03 13:15:01 centos8.ittraining.loc systemd[1]: Started Session 257 of user trainee. | ||
| + | Jun 03 13:15:01 centos8.ittraining.loc CROND[5407]: | ||
| + | Jun 03 13:15:01 centos8.ittraining.loc systemd[1]: session-257.scope: | ||
| + | Jun 03 13:16:02 centos8.ittraining.loc systemd[1]: Started Session 258 of user trainee. | ||
| + | Jun 03 13:16:02 centos8.ittraining.loc CROND[5420]: | ||
| + | Jun 03 13:16:02 centos8.ittraining.loc systemd[1]: session-258.scope: | ||
| + | ^C | ||
| </ | </ | ||
| - | ====3.6 - La Commande warnquota==== | + | Ouvrez un deuxième terminal |
| - | + | ||
| - | La commande **warnquota** vérifie le ou les disques | + | |
| - | + | ||
| - | Sous RHEL/ | + | |
| < | < | ||
| - | [root@centos8 ~]# which warnquota | + | [trainee@centos8 ~]$ logger -p user.info Linux est super |
| - | / | + | |
| </ | </ | ||
| - | Installez donc le paquet **quota-warnquota** | + | Retournez consulter |
| < | < | ||
| - | [root@centos7 | + | [root@centos8 |
| - | ... | + | -- Logs begin at Thu 2021-06-03 09:01:10 EDT. -- |
| + | Jun 03 13:13:08 centos8.ittraining.loc systemd[1]: Started | ||
| + | Jun 03 13:14:01 centos8.ittraining.loc systemd[1]: Started Session 256 of user trainee. | ||
| + | Jun 03 13:14:01 centos8.ittraining.loc CROND[5391]: | ||
| + | Jun 03 13:14:01 centos8.ittraining.loc systemd[1]: session-256.scope: Succeeded. | ||
| + | Jun 03 13:15:01 centos8.ittraining.loc systemd[1]: Started Session 257 of user trainee. | ||
| + | Jun 03 13:15:01 centos8.ittraining.loc CROND[5407]: | ||
| + | Jun 03 13:15:01 centos8.ittraining.loc systemd[1]: session-257.scope: | ||
| + | Jun 03 13:16:02 centos8.ittraining.loc systemd[1]: Started Session 258 of user trainee. | ||
| + | Jun 03 13:16:02 centos8.ittraining.loc CROND[5420]: | ||
| + | Jun 03 13:16:02 centos8.ittraining.loc systemd[1]: session-258.scope: | ||
| + | Jun 03 13:17:01 centos8.ittraining.loc systemd[1]: Started Session 259 of user trainee. | ||
| + | Jun 03 13:17:01 centos8.ittraining.loc CROND[5436]: | ||
| + | Jun 03 13:17:01 centos8.ittraining.loc systemd[1]: session-259.scope: | ||
| + | Jun 03 13:17:19 centos8.ittraining.loc sshd[5439]: Accepted password for trainee from 10.0.2.2 port 39906 ssh2 | ||
| + | Jun 03 13:17:19 centos8.ittraining.loc systemd-logind[880]: | ||
| + | Jun 03 13:17:19 centos8.ittraining.loc systemd[1]: Started Session 260 of user trainee. | ||
| + | Jun 03 13:17:19 centos8.ittraining.loc sshd[5439]: pam_unix(sshd: | ||
| + | Jun 03 13:17:34 centos8.ittraining.loc trainee[5470]: | ||
| + | Jun 03 13:17:34 centos8.ittraining.loc rsyslogd[1113]: | ||
| + | Jun 03 13:18:01 centos8.ittraining.loc systemd[1]: Started Session 261 of user trainee. | ||
| + | Jun 03 13:18:01 centos8.ittraining.loc CROND[5481]: | ||
| + | Jun 03 13:18:01 centos8.ittraining.loc systemd[1]: session-261.scope: | ||
| + | ^C | ||
| </ | </ | ||
| - | Les options | + | <WRAP center round important 60%> |
| + | **Important** : Notez la présence | ||
| + | </ | ||
| + | |||
| + | ====5.7 - Consultation des Journaux avec des Mots Clefs=== | ||
| + | |||
| + | Pour consulter les mots clefs compris par Journald, tapez la commande **journalctl** puis appuyer **deux** fois sur la touche < | ||
| < | < | ||
| - | [root@centos8 ~]# warnquota --help | + | [root@centos8 ~]# journalctl |
| - | warnquota: Usage: | + | _AUDIT_LOGINUID= |
| - | warnquota | + | _AUDIT_SESSION= |
| + | AVAILABLE= | ||
| + | AVAILABLE_PRETTY= | ||
| + | _BOOT_ID= | ||
| + | _CAP_EFFECTIVE= | ||
| + | _CMDLINE= | ||
| + | CODE_FILE= | ||
| + | CODE_FUNC= | ||
| + | CODE_LINE= | ||
| + | _COMM= | ||
| + | CURRENT_USE= | ||
| + | CURRENT_USE_PRETTY= | ||
| + | DISK_AVAILABLE= | ||
| + | DISK_AVAILABLE_PRETTY= | ||
| + | DISK_KEEP_FREE= | ||
| + | DISK_KEEP_FREE_PRETTY= | ||
| + | _EXE= | ||
| + | _GID= | ||
| + | </ | ||
| - | -u, --user | + | Pour voir la liste des processus dont les traces sont inclus dans les journaux du mots clefs, tapez la commande journalctl suivi par le nom d'un mot clef puis appuyer deux fois sur la touche < |
| - | -g, --group | + | |
| - | -s, --human-readable | + | |
| - | -i, --no-autofs | + | |
| - | -d, --no-details | + | |
| - | -F, --format=formatname | + | |
| - | -c, --config=config-file | + | |
| - | -q, --quota-tab=quotatab-file | + | |
| - | -a, --admins-file=admins-file | + | |
| - | -h, --help | + | |
| - | -v, --version | + | |
| - | warnquota: Bugs to jack@suse.cz | + | < |
| + | [root@centos8 ~]# journalctl _UID= | ||
| + | 0 | ||
| + | [root@centos8 ~]# journalctl _COMM= | ||
| + | anacron | ||
| + | auditd | ||
| + | augenrules | ||
| + | chronyd | ||
| + | crond firewalld | ||
| </ | </ | ||
| ----- | ----- | ||
| Copyright © 2024 Hugh Norris. | Copyright © 2024 Hugh Norris. | ||
