Différences
Ci-dessous, les différences entre deux révisions de la page.
| Prochaine révision | Révision précédente | ||
| elearning:workbooks:debian:10:junior:l114 [2022/04/29 07:57] – created admin | elearning:workbooks:debian:10:junior:l114 [2024/03/08 08:41] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| ~~PDF: | ~~PDF: | ||
| - | Version : **2022.01** | + | Version : **2024.01** |
| Dernière mise-à-jour : ~~LASTMOD~~ | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| - | ======LDF208 | + | ======LDF508 |
| =====Contenu du Module===== | =====Contenu du Module===== | ||
| - | * **LDF208 | + | * **LDF508 |
| * Contenu du Module | * Contenu du Module | ||
| * Présentation | * Présentation | ||
| * La Commande dmesg | * La Commande dmesg | ||
| - | * Surveillance Sécuritaire | + | * LAB #1 - Surveillance Sécuritaire |
| - | * La Commande last | + | * 1.1 - La Commande last |
| - | * La Commande lastlog | + | * 1.2 - La Commande lastlog |
| - | * La Commande lastb | + | * 1.3 - La Commande lastb |
| - | * Le fichier / | + | * 1.4 - Le fichier / |
| - | * Le fichier / | + | * 1.5 - Gestion des évènements audit |
| - | * Gestion des événements audit | + | |
| * auditd | * auditd | ||
| * auditctl | * auditctl | ||
| * audispd | * audispd | ||
| - | | + | |
| - | * La Commande aureport | + | * La Commande aureport |
| - | * La Commande ausearch | + | * La Commande ausearch |
| * Le fichier / | * Le fichier / | ||
| * Applications | * Applications | ||
| - | * rsyslog | + | * LAB #2 - rsyslog |
| - | * Priorités | + | * 2.1 - Priorités |
| - | * Sous-systèmes applicatifs | + | * 2.2 - Sous-systèmes applicatifs |
| - | * / | + | * 2.3 - / |
| * Modules | * Modules | ||
| * Directives Globales | * Directives Globales | ||
| Ligne 41: | Ligne 41: | ||
| * n Sous-systèmes avec la même priorité | * n Sous-systèmes avec la même priorité | ||
| * n Sélecteurs avec la même Action | * n Sélecteurs avec la même Action | ||
| - | * La Commande logger | + | * LAB #3 - La Commande logger |
| - | * La Commande logrotate | + | * LAB #4 - La Commande logrotate |
| - | * La Journalisation avec journald | + | * LAB #5 - La Journalisation avec journald |
| - | * Consultation des Journaux | + | * 5.1 - Consultation des Journaux |
| - | * Consultation des Journaux d'une Application Spécifique | + | * 5.2 - Consultation des Journaux d'une Application Spécifique |
| - | * Consultation des Journaux depuis le Dernier Démarrage | + | * 5.3 - Consultation des Journaux depuis le Dernier Démarrage |
| - | * Consultation des Journaux d'une Priorité Spécifique | + | * 5.4 - Consultation des Journaux d'une Priorité Spécifique |
| - | * Consultation des Journaux d'une Plage de Dates ou d' | + | * 5.5 - Consultation des Journaux d'une Plage de Dates ou d' |
| - | * Consultation des Journaux en Live | + | * 5.6 - Consultation des Journaux en Live |
| - | * Consultation des Journaux avec des Mots Clefs | + | |
| =====Présentation===== | =====Présentation===== | ||
| Ligne 65: | Ligne 64: | ||
| < | < | ||
| - | root@debian8:~# dmesg | more | + | root@debian11:~# dmesg | more |
| - | [ 0.000000] Initializing cgroup subsys cpuset | + | [ 0.000000] Linux version |
| - | [ 0.000000] Initializing cgroup subsys cpu | + | .35.2) #1 SMP Debian |
| - | [ 0.000000] Initializing cgroup subsys cpuacct | + | [ 0.000000] |
| - | [ 0.000000] Linux version | + | [ 0.000000] x86/fpu: x87 FPU will use FXSAVE |
| - | bian 4.8.4-1) ) #1 SMP Debian | + | [ 0.000000] |
| - | [ 0.000000] | + | |
| [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable | [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable | ||
| [ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved | [ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved | ||
| [ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved | [ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved | ||
| - | [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x000000003ffeffff] usable | + | [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000bffd9fff] usable |
| - | [ 0.000000] BIOS-e820: [mem 0x000000003fff0000-0x000000003fffffff] ACPI data | + | [ 0.000000] BIOS-e820: [mem 0x00000000bffda000-0x00000000bfffffff] reserved |
| + | [ 0.000000] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved | ||
| [ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved | [ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved | ||
| + | [ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000013fffffff] usable | ||
| [ 0.000000] NX (Execute Disable) protection: active | [ 0.000000] NX (Execute Disable) protection: active | ||
| - | [ 0.000000] SMBIOS 2.5 present. | + | [ 0.000000] SMBIOS 2.8 present. |
| - | [ 0.000000] DMI: innotek GmbH VirtualBox/ | + | [ 0.000000] DMI: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 |
| - | [ 0.000000] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved | + | [ 0.000000] Hypervisor detected: KVM |
| - | [ 0.000000] e820: remove [mem 0x000a0000-0x000fffff] usable | + | [ 0.000000] kvm-clock: Using msrs 4b564d01 and 4b564d00 |
| - | [ 0.000000] e820: last_pfn = 0x3fff0 | + | [ 0.000000] kvm-clock: cpu 0, msr 5ccb8001, primary cpu clock |
| - | [ 0.000000] MTRR default type: uncachable | + | [ 0.000000] kvm-clock: using sched offset of 10164710878 cycles |
| - | [ 0.000000] MTRR variable ranges | + | [ 0.000006] clocksource: |
| - | [ 0.000000] x86 PAT enabled: cpu 0, old 0x7040600070406, | + | [ 0.000013] tsc: Detected 2399.982 MHz processor |
| - | [ 0.000000] CPU MTRRs all blank - virtualized system. | + | [ 0.000754] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved |
| - | [ 0.000000] initial memory mapped: [mem 0x00000000-0x01bfffff] | + | [ 0.000757] e820: remove [mem 0x000a0000-0x000fffff] usable |
| + | [ 0.000761] last_pfn = 0x140000 | ||
| + | [ 0.000789] MTRR default type: write-back | ||
| + | [ 0.000791] MTRR fixed ranges enabled: | ||
| + | [ 0.000792] | ||
| + | [ 0.000793] | ||
| + | [ 0.000794] | ||
| + | [ 0.000795] MTRR variable ranges | ||
| + | [ 0.000796] | ||
| + | [ 0.000797] | ||
| + | [ 0.000797] | ||
| + | [ 0.000798] | ||
| + | [ 0.000798] | ||
| + | [ 0.000799] | ||
| + | [ 0.000799] | ||
| + | [ 0.000800] | ||
| + | [ 0.000815] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WC UC- UC | ||
| + | [ 0.000826] last_pfn = 0xbffda max_arch_pfn = 0x400000000 | ||
| + | [ 0.009867] found SMP MP-table at [mem 0x000f5a80-0x000f5a8f] | ||
| + | [ 0.010459] RAMDISK: [mem 0x3304d000-0x3581dfff] | ||
| + | [ 0.010467] ACPI: Early table checksum verification disabled | ||
| + | [ 0.010479] ACPI: RSDP 0x00000000000F5880 000014 (v00 BOCHS ) | ||
| + | [ 0.010487] ACPI: RSDT 0x00000000BFFE145E 000038 (v01 BOCHS BXPCRSDT 00000001 BXPC 00000001) | ||
| + | [ 0.010497] ACPI: FACP 0x00000000BFFE1240 000074 (v01 BOCHS BXPCFACP 00000001 BXPC 00000001) | ||
| --More-- | --More-- | ||
| + | [q] | ||
| </ | </ | ||
| - | |||
| - | ====Options de la Commande==== | ||
| Les option de cette commande sont : | Les option de cette commande sont : | ||
| < | < | ||
| - | root@debian8:~# dmesg --help | + | root@debian11:~# dmesg --help |
| Usage: | Usage: | ||
| dmesg [options] | dmesg [options] | ||
| + | |||
| + | Display or control the kernel ring buffer. | ||
| Options: | Options: | ||
| Ligne 112: | Ligne 136: | ||
| -k, --kernel | -k, --kernel | ||
| -L, --color[=< | -L, --color[=< | ||
| + | | ||
| -l, --level < | -l, --level < | ||
| -n, --console-level < | -n, --console-level < | ||
| -P, --nopager | -P, --nopager | ||
| + | -p, --force-prefix | ||
| -r, --raw print the raw message buffer | -r, --raw print the raw message buffer | ||
| + | | ||
| -S, --syslog | -S, --syslog | ||
| -s, --buffer-size < | -s, --buffer-size < | ||
| -u, --userspace | -u, --userspace | ||
| -w, --follow | -w, --follow | ||
| + | -W, --follow-new | ||
| -x, --decode | -x, --decode | ||
| -d, --show-delta | -d, --show-delta | ||
| -e, --reltime | -e, --reltime | ||
| - | -T, --ctime | + | -T, --ctime |
| - | -t, --notime | + | -t, --notime |
| - | | + | |
| | | ||
| Suspending/ | Suspending/ | ||
| - | -h, --help | + | -h, --help |
| - | -V, --version | + | -V, --version |
| Supported log facilities: | Supported log facilities: | ||
| Ligne 151: | Ligne 179: | ||
| info - informational | info - informational | ||
| debug - debug-level messages | debug - debug-level messages | ||
| - | |||
| For more details see dmesg(1). | For more details see dmesg(1). | ||
| </ | </ | ||
| - | =====Surveillance Sécuritaire===== | + | =====LAB #1 - Surveillance Sécuritaire===== |
| - | ====La Commande last==== | + | ====1.1 - La Commande last==== |
| Cette commande indique les dates et heures des connexions des utilisateurs à partir du contenu du fichier **/ | Cette commande indique les dates et heures des connexions des utilisateurs à partir du contenu du fichier **/ | ||
| < | < | ||
| - | root@debian8:~# last | + | root@debian11:~# last |
| - | trainee | + | trainee |
| - | trainee | + | trainee |
| - | trainee | + | trainee |
| - | reboot | + | trainee |
| - | trainee | + | reboot |
| - | trainee | + | trainee |
| - | reboot | + | reboot |
| - | trainee | + | trainee |
| - | trainee | + | trainee |
| - | reboot | + | reboot |
| - | trainee | + | |
| - | trainee | + | |
| - | reboot | + | |
| - | reboot | + | |
| - | wtmp begins | + | wtmp begins |
| </ | </ | ||
| - | ===Options de la Commande=== | ||
| Les option de cette commande sont : | Les option de cette commande sont : | ||
| < | < | ||
| - | root@debian8:~# last --help | + | root@debian11:~# last --help |
| - | last: invalid option -- ' | + | |
| - | Usage: last [-num | -n num] [-f file] [-t YYYYMMDDHHMMSS] [-R] [-adioxFw] [username..] [tty..] | + | Usage: |
| + | last [options] [<username>...] [<tty>...] | ||
| + | |||
| + | Show a listing of last logged in users. | ||
| + | |||
| + | Options: | ||
| + | | ||
| + | -a, --hostlast | ||
| + | -d, --dns translate the IP number back into a hostname | ||
| + | -f, --file < | ||
| + | -F, --fulltimes | ||
| + | -i, --ip | ||
| + | -n, --limit < | ||
| + | -R, --nohostname | ||
| + | -s, --since < | ||
| + | -t, --until < | ||
| + | -p, --present < | ||
| + | -w, --fullnames | ||
| + | -x, --system | ||
| + | | ||
| + | | ||
| + | |||
| + | -h, --help | ||
| + | -V, --version | ||
| + | |||
| + | For more details see last(1). | ||
| </ | </ | ||
| - | ====La Commande lastlog==== | + | ====1.2 - La Commande lastlog==== |
| Cette commande indique les dates et heures de la connexion au système la plus récente des utilisateurs : | Cette commande indique les dates et heures de la connexion au système la plus récente des utilisateurs : | ||
| < | < | ||
| - | root@debian8:~# lastlog | + | root@debian11:~# lastlog |
| Username | Username | ||
| root | root | ||
| Ligne 217: | Ligne 264: | ||
| gnats **Never logged in** | gnats **Never logged in** | ||
| nobody | nobody | ||
| - | systemd-timesync | + | _apt **Never logged in** |
| systemd-network | systemd-network | ||
| systemd-resolve | systemd-resolve | ||
| - | systemd-bus-proxy | ||
| messagebus | messagebus | ||
| - | pulse | + | systemd-timesync |
| - | avahi | + | usbmux |
| - | uuidd **Never logged in** | + | rtkit |
| - | Debian-exim | + | |
| - | statd **Never logged in** | + | |
| - | avahi-autoipd | + | |
| - | colord | + | |
| dnsmasq | dnsmasq | ||
| - | geoclue | + | avahi |
| speech-dispatcher | speech-dispatcher | ||
| - | sshd | + | pulse |
| - | rtkit | + | |
| saned **Never logged in** | saned **Never logged in** | ||
| - | usbmux | + | colord |
| - | hplip | + | |
| lightdm | lightdm | ||
| - | trainee | + | trainee |
| - | vboxadd | + | systemd-coredump |
| + | sshd **Never logged in** | ||
| </ | </ | ||
| - | |||
| - | ===Options de la Commande=== | ||
| Les option de cette commande sont : | Les option de cette commande sont : | ||
| < | < | ||
| - | root@debian8:~# lastlog --help | + | root@debian11:~# lastlog --help |
| Usage: lastlog [options] | Usage: lastlog [options] | ||
| Options: | Options: | ||
| -b, --before DAYS print only lastlog records older than DAYS | -b, --before DAYS print only lastlog records older than DAYS | ||
| + | -C, --clear | ||
| -h, --help | -h, --help | ||
| -R, --root CHROOT_DIR | -R, --root CHROOT_DIR | ||
| + | -S, --set set lastlog record to current time (usable only with -u) | ||
| -t, --time DAYS print only lastlog records more recent than DAYS | -t, --time DAYS print only lastlog records more recent than DAYS | ||
| -u, --user LOGIN print lastlog record of the specified LOGIN | -u, --user LOGIN print lastlog record of the specified LOGIN | ||
| </ | </ | ||
| - | ====La Commande lastb==== | + | ====1.3 - La Commande lastb==== |
| Cette commande indique les dates et heures des connexions infructueueses des utilisateurs à partir du contenu du fichier **/ | Cette commande indique les dates et heures des connexions infructueueses des utilisateurs à partir du contenu du fichier **/ | ||
| < | < | ||
| - | root@debian8:~# lastb | + | root@debian11:~# lastb |
| - | trainee | + | trainee |
| - | trainee | + | trainee |
| - | trainee | + | trainee |
| - | trainee | + | trainee |
| - | trainee | + | trainee |
| - | trainee | + | trainee |
| - | trainee | + | |
| - | btmp begins | + | btmp begins |
| </ | </ | ||
| - | |||
| - | ===Options de la Commande=== | ||
| Les options de cette commande sont : | Les options de cette commande sont : | ||
| < | < | ||
| - | root@debian8:~# lastb --help | + | root@debian11:~# lastb --help |
| - | lastb: invalid option -- ' | + | |
| - | Usage: lastb [-num | -n num] [-f file] [-t YYYYMMDDHHMMSS] [-R] [-adioxFw] [username..] [tty..] | + | Usage: |
| + | lastb [options] [<username>...] [<tty>...] | ||
| + | |||
| + | Show a listing of last logged in users. | ||
| + | |||
| + | Options: | ||
| + | | ||
| + | -a, --hostlast | ||
| + | -d, --dns translate the IP number back into a hostname | ||
| + | -f, --file < | ||
| + | -F, --fulltimes | ||
| + | -i, --ip | ||
| + | -n, --limit < | ||
| + | -R, --nohostname | ||
| + | -s, --since < | ||
| + | -t, --until < | ||
| + | -p, --present < | ||
| + | -w, --fullnames | ||
| + | -x, --system | ||
| + | | ||
| + | | ||
| + | |||
| + | -h, --help | ||
| + | -V, --version | ||
| + | |||
| + | For more details see last(1). | ||
| </ | </ | ||
| - | ====Le fichier / | + | ====1.4 - Le fichier / |
| Sous Debian, ces mêmes informations se trouvent dans le fichier **/ | Sous Debian, ces mêmes informations se trouvent dans le fichier **/ | ||
| < | < | ||
| - | root@debian8:~# tail -n 15 / | + | root@debian11:~# tail -n 15 / |
| - | Oct 28 14:29:01 debian8 CRON[4497]: pam_unix(cron: | + | Apr 29 14:22:22 debian11 sshd[45387]: Failed password |
| - | Oct 28 14:30:01 debian8 CRON[4504]: pam_unix(cron: | + | Apr 29 14:22:23 debian11 sshd[45387]: Connection |
| - | Oct 28 14:30:01 debian8 CRON[4504]: pam_unix(cron: | + | Apr 29 14:22:23 debian11 sshd[45387]: PAM 2 more authentication failures; logname= |
| - | Oct 28 14:31:01 debian8 CRON[4508]: pam_unix(cron: | + | Apr 29 14:22:29 debian11 sshd[45391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.1 |
| - | Oct 28 14:31:01 debian8 CRON[4508]: pam_unix(cron: | + | Apr 29 14:22:31 debian11 sshd[45391]: Failed password for trainee from 10.0.2.1 port 55296 ssh2 |
| - | Oct 28 14:31:30 debian8 su[1558]: pam_unix(su: | + | Apr 29 14:22:35 debian11 sshd[45391]: Failed password |
| - | Oct 28 14:31:36 debian8 su[4513]: pam_unix(su:auth): authentication failure; logname=trainee | + | Apr 29 14:22:40 debian11 sshd[45391]: Failed password for trainee from 10.0.2.1 port 55296 ssh2 |
| - | Oct 28 14:31:38 debian8 su[4513]: pam_authenticate: | + | Apr 29 14:22:41 debian11 sshd[45391]: Connection closed |
| - | Oct 28 14:31:38 debian8 su[4513]: FAILED su for root by trainee | + | Apr 29 14:22:41 debian11 sshd[45391]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.2.1 |
| - | Oct 28 14:31:38 debian8 su[4513]: - /dev/pts/0 trainee: | + | Apr 29 14:22:46 debian11 sshd[45393]: |
| - | Oct 28 14:31:46 debian8 su[4514]: Successful su for root by trainee | + | Apr 29 14:22:46 debian11 sshd[45393]: pam_unix(sshd:session): session opened for user trainee(uid=1000) by (uid=0) |
| - | Oct 28 14:31:46 debian8 su[4514]: + /dev/pts/0 trainee:root | + | Apr 29 14:22:46 debian11 systemd-logind[385]: New session 142 of user trainee. |
| - | Oct 28 14:31:46 debian8 su[4514]: pam_unix(su:session): session opened for user root by trainee(uid=1000) | + | Apr 29 14:22:46 debian11 systemd: pam_unix(systemd-user:session): session opened for user trainee(uid=1000) |
| - | Oct 28 14:32:01 debian8 CRON[4522]: pam_unix(cron:session): session opened for user trainee by (uid=0) | + | Apr 29 14:22:52 debian11 su: (to root) trainee on pts/0 |
| - | Oct 28 14:32:01 debian8 CRON[4522]: pam_unix(cron:session): session | + | Apr 29 14:22:52 debian11 su: pam_unix(su-l:session): session |
| </ | </ | ||
| - | =====Le fichier /var/log/audit/audit.log===== | + | ====1.5 - Gestion des Evénements |
| - | Ce fichier contient les messages du système d' | + | ===Le fichier / |
| + | |||
| + | Ce fichier contient les messages du système d' | ||
| * des appels système, | * des appels système, | ||
| Ligne 319: | Ligne 384: | ||
| < | < | ||
| - | root@debian8:~# apt-get | + | root@debian11:~# apt-get -y install |
| - | Reading package lists... Done | + | |
| - | Building dependency tree | + | |
| - | Reading state information... Done | + | |
| - | The following extra packages will be installed: | + | |
| - | libauparse0 | + | |
| - | Suggested packages: | + | |
| - | audispd-plugins | + | |
| - | The following NEW packages will be installed: | + | |
| - | auditd libauparse0 | + | |
| - | 0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. | + | |
| - | Need to get 262 kB of archives. | + | |
| - | After this operation, 712 kB of additional disk space will be used. | + | |
| - | Do you want to continue? [Y/n] y | + | |
| - | Get:1 http:// | + | |
| - | Get:2 http:// | + | |
| - | Fetched 262 kB in 1s (168 kB/s) | + | |
| - | Selecting previously unselected package libauparse0: | + | |
| - | (Reading database ... 167450 files and directories currently installed.) | + | |
| - | Preparing to unpack .../ | + | |
| - | Unpacking libauparse0: | + | |
| - | Selecting previously unselected package auditd. | + | |
| - | Preparing to unpack .../ | + | |
| - | Unpacking auditd (1: | + | |
| - | Processing triggers for man-db (2.7.0.2-5) ... | + | |
| - | Processing triggers for systemd (215-17+deb8u2) ... | + | |
| - | Setting up libauparse0: | + | |
| - | Setting up auditd (1: | + | |
| - | update-rc.d: | + | |
| - | Processing triggers for libc-bin (2.19-18+deb8u1) ... | + | |
| - | Processing triggers for systemd (215-17+deb8u2) ... | + | |
| </ | </ | ||
| Ligne 355: | Ligne 390: | ||
| < | < | ||
| - | root@debian8:~# tail -n 15 / | + | root@debian11:~# tail -n 15 / |
| - | type=USER_START | + | type=DAEMON_START |
| - | type=CRED_DISP msg=audit(1446039481.864:900): pid=4559 uid=0 auid=1000 ses=443 msg=' | + | type=CONFIG_CHANGE |
| - | type=USER_END msg=audit(1446039481.864:901): pid=4559 uid=0 auid=1000 ses=443 msg=' | + | type=CONFIG_CHANGE |
| - | type=USER_ACCT msg=audit(1446039541.874:902): pid=4567 uid=0 auid=4294967295 | + | type=CONFIG_CHANGE |
| - | type=CRED_ACQ msg=audit(1446039541.874: | + | type=SERVICE_START |
| - | type=LOGIN msg=audit(1446039541.874:904): pid=4567 uid=0 old-auid=4294967295 | + | |
| - | type=USER_START msg=audit(1446039541.874: | + | |
| - | type=CRED_DISP msg=audit(1446039541.878: | + | |
| - | type=USER_END | + | |
| - | type=USER_ACCT msg=audit(1446039601.888: | + | |
| - | type=CRED_ACQ | + | |
| - | type=LOGIN msg=audit(1446039601.888:910): pid=4571 uid=0 old-auid=4294967295 | + | |
| - | type=USER_START msg=audit(1446039601.888: | + | |
| - | type=CRED_DISP msg=audit(1446039601.896: | + | |
| - | type=USER_END msg=audit(1446039601.896: | + | |
| </ | </ | ||
| - | |||
| - | ====Gestion des évènements audit==== | ||
| La gestion des évènements audit se repose sur trois exécutables : | La gestion des évènements audit se repose sur trois exécutables : | ||
| Ligne 382: | Ligne 405: | ||
| < | < | ||
| - | root@debian8:~# cat / | + | root@debian11:~# cat / |
| # | # | ||
| # This file controls the configuration of the audit daemon | # This file controls the configuration of the audit daemon | ||
| # | # | ||
| + | local_events = yes | ||
| + | write_logs = yes | ||
| log_file = / | log_file = / | ||
| - | log_format = RAW | + | log_group = adm |
| - | log_group = root | + | log_format |
| - | priority_boost | + | flush = INCREMENTAL_ASYNC |
| - | flush = INCREMENTAL | + | freq = 50 |
| - | freq = 20 | + | max_log_file = 8 |
| num_logs = 5 | num_logs = 5 | ||
| - | disp_qos | + | priority_boost |
| - | dispatcher = / | + | |
| name_format = NONE | name_format = NONE | ||
| ##name = mydomain | ##name = mydomain | ||
| - | max_log_file = 6 | ||
| max_log_file_action = ROTATE | max_log_file_action = ROTATE | ||
| space_left = 75 | space_left = 75 | ||
| space_left_action = SYSLOG | space_left_action = SYSLOG | ||
| + | verify_email = yes | ||
| action_mail_acct = root | action_mail_acct = root | ||
| admin_space_left = 50 | admin_space_left = 50 | ||
| Ligne 407: | Ligne 431: | ||
| disk_full_action = SUSPEND | disk_full_action = SUSPEND | ||
| disk_error_action = SUSPEND | disk_error_action = SUSPEND | ||
| - | ## | + | use_libwrap = yes |
| + | ## | ||
| tcp_listen_queue = 5 | tcp_listen_queue = 5 | ||
| tcp_max_per_addr = 1 | tcp_max_per_addr = 1 | ||
| ## | ## | ||
| tcp_client_max_idle = 0 | tcp_client_max_idle = 0 | ||
| - | enable_krb5 | + | transport |
| krb5_principal = auditd | krb5_principal = auditd | ||
| ## | ## | ||
| + | distribute_network = no | ||
| + | q_depth = 400 | ||
| + | overflow_action = SYSLOG | ||
| + | max_restarts = 10 | ||
| + | plugin_dir = / | ||
| </ | </ | ||
| - | |||
| - | ==Options de la Commande== | ||
| Les option de cette commande sont : | Les option de cette commande sont : | ||
| < | < | ||
| - | root@debian8:~# auditd --help | + | root@debian11:~# auditd --help |
| - | auditd: | + | auditd: |
| - | Usage: auditd [-f] [-l] [-n] [-s disable|enable|nochange] | + | Usage: auditd [-f] [-l] [-n] [-s disable|enable|nochange] [-c < |
| </ | </ | ||
| ===auditctl=== | ===auditctl=== | ||
| - | Cet exécutable est utilisé pour configurer les règles du système audit. Au démarrage, auditctl lit et applique les règles | + | Cet exécutable est utilisé pour configurer les règles du système audit. Au démarrage, auditctl lit et applique les règles |
| < | < | ||
| - | root@debian8:~# cat / | + | root@debian11:~# cat / |
| - | # This file contains the auditctl rules that are loaded | + | ## This file is automatically generated from /etc/audit/rules.d |
| - | # whenever the audit daemon is started via the initscripts. | + | |
| - | # The rules are simply the parameters that would be passed | + | |
| - | # to auditctl. | + | |
| - | + | ||
| - | # First rule - delete all | + | |
| -D | -D | ||
| - | + | -b 8192 | |
| - | # Increase the buffers to survive stress events. | + | -f 1 |
| - | # Make this bigger for busy systems | + | --backlog_wait_time 60000 |
| - | -b 320 | + | |
| - | + | ||
| - | # Feel free to add below this line. See auditctl man pag | + | |
| </ | </ | ||
| - | |||
| - | ==Options de la Commande== | ||
| Les options de cette commande sont : | Les options de cette commande sont : | ||
| < | < | ||
| - | root@debian8:~# auditctl --help | + | root@debian11:~# auditctl -h |
| usage: auditctl [options] | usage: auditctl [options] | ||
| - | -a < | + | -a < |
| - | -A < | + | -A < |
| - | -b < | + | -b < |
| - | allowed Default=64 | + | allowed Default=64 |
| - | -c Continue through errors in rules | + | -c Continue through errors in rules |
| - | -C f=f Compare collected fields if available: | + | -C f=f Compare collected fields if available: |
| - | Field name, operator(=, | + | Field name, operator(=, |
| - | -d < | + | -d < |
| - | l=task, | + | l=task, |
| - | a=never, | + | a=never, |
| - | -D Delete all rules and watches | + | -D Delete all rules and watches |
| - | -e [0..2] | + | -e [0..2] |
| - | -f [0..2] | + | -f [0..2] |
| - | 0=silent 1=printk 2=panic | + | 0=silent 1=printk 2=panic |
| - | -F f=v Build rule: field name, operator(=, | + | -F f=v Build rule: field name, operator(=, |
| - | > | + | > |
| - | -h Help | + | -h Help |
| - | -i Ignore errors when reading rules from file | + | -i Ignore errors when reading rules from file |
| - | -k < | + | -k < |
| - | -l List rules | + | -l List rules |
| - | -m text | + | -m text |
| - | -p [r|w|x|a] | + | -p [r|w|x|a] |
| - | r=read, w=write, x=execute, a=attribute | + | r=read, w=write, x=execute, a=attribute |
| - | -q < | + | -q < |
| - | -r < | + | -r < |
| - | -R < | + | -R < |
| - | -s Report status | + | -s Report status |
| - | -S syscall | + | -S syscall |
| - | -t Trim directory watches | + | |
| - | -v Version | + | -v Version |
| - | -w < | + | -w < |
| - | -W < | + | -W < |
| - | --loginuid-immutable | + | --loginuid-immutable |
| + | --backlog_wait_time | ||
| + | --reset-lost | ||
| + | --reset_backlog_wait_time_actual | ||
| </ | </ | ||
| | | ||
| ===audispd=== | ===audispd=== | ||
| - | Cet exécutable est responsable de la distribution des évènements | + | Cet exécutable est responsable de la distribution des événements |
| < | < | ||
| - | root@debian8:~# ls /etc/audisp/plugins.d | + | root@debian11:~# ls /etc/audit/plugins.d |
| af_unix.conf | af_unix.conf | ||
| </ | </ | ||
| Ligne 502: | Ligne 523: | ||
| < | < | ||
| - | root@debian8:~# cat /etc/audisp/ | + | root@debian11:~# cat /etc/audit/ |
| # This file controls the configuration of the syslog plugin. | # This file controls the configuration of the syslog plugin. | ||
| # It simply takes events and writes them to syslog. The | # It simply takes events and writes them to syslog. The | ||
| Ligne 508: | Ligne 529: | ||
| # want the events written with. And optionally, you can give | # want the events written with. And optionally, you can give | ||
| # a second argument indicating the facility that you want events | # a second argument indicating the facility that you want events | ||
| - | # logged to. Valid options are LOG_LOCAL0 through 7. | + | # logged to. Valid options are LOG_LOCAL0 through 7, LOG_AUTH, |
| + | # LOG_AUTHPRIV, | ||
| active = no | active = no | ||
| direction = out | direction = out | ||
| - | path = builtin_syslog | + | path = / |
| - | type = builtin | + | type = always |
| args = LOG_INFO | args = LOG_INFO | ||
| format = string | format = string | ||
| </ | </ | ||
| - | ====La consultation des évènements | + | ===La consultation des événements |
| - | La consultation des évènements | + | La consultation des événements |
| - | ===La Commande aureport=== | + | ==La Commande aureport== |
| Cette commande est utilisée pour générer des rapports : | Cette commande est utilisée pour générer des rapports : | ||
| < | < | ||
| - | root@debian8:~# aureport | + | root@debian11:~# aureport |
| Summary Report | Summary Report | ||
| ====================== | ====================== | ||
| - | Range of time in logs: 10/28/2015 06:37:21.563 - 10/28/2015 14:48:01.088 | + | Range of time in logs: 04/29/2022 14:24:25.372 - 04/29/2022 14:24:25.388 |
| - | Selected time for report: | + | Selected time for report: |
| - | Number of changes in configuration: | + | Number of changes in configuration: |
| Number of changes to accounts, groups, or roles: 0 | Number of changes to accounts, groups, or roles: 0 | ||
| Number of logins: 0 | Number of logins: 0 | ||
| Number of failed logins: 0 | Number of failed logins: 0 | ||
| - | Number of authentications: | + | Number of authentications: |
| - | Number of failed authentications: | + | Number of failed authentications: |
| - | Number of users: | + | Number of users: |
| - | Number of terminals: | + | Number of terminals: |
| Number of host names: 1 | Number of host names: 1 | ||
| - | Number of executables: | + | Number of executables: |
| + | Number of commands: 1 | ||
| Number of files: 0 | Number of files: 0 | ||
| Number of AVC's: 0 | Number of AVC's: 0 | ||
| Ligne 550: | Ligne 573: | ||
| Number of responses to anomaly events: 0 | Number of responses to anomaly events: 0 | ||
| Number of crypto events: 0 | Number of crypto events: 0 | ||
| + | Number of integrity events: 0 | ||
| + | Number of virt events: 0 | ||
| Number of keys: 0 | Number of keys: 0 | ||
| - | Number of process IDs: 163 | + | Number of process IDs: 2 |
| - | Number of events: | + | Number of events: |
| </ | </ | ||
| Ligne 558: | Ligne 583: | ||
| < | < | ||
| - | root@debian8:~# aureport --help | + | root@debian11:~# aureport --help |
| usage: aureport [options] | usage: aureport [options] | ||
| - | -a,--avc Avc report | + | |
| - | -au, | + | -au, |
| - | -c, | + | |
| - | -cr, | + | |
| - | -e, | + | -cr, |
| - | -f,--file File name report | + | -e, |
| - | --failed only failed events in report | + | -f, |
| - | -h,--host Remote Host name report | + | --failed |
| - | --help help | + | -h, |
| - | -i, | + | --help |
| - | -if, | + | -i, |
| - | --input-logs Use the logs even if stdin is a pipe | + | -if,--input <Input File name> |
| - | -l, | + | --input-logs |
| - | -k,--key Key report | + | |
| - | -m,--mods Modification to accounts report | + | |
| - | -ma,--mac Mandatory Access Control (MAC) report | + | -k, |
| - | -n, | + | -m, |
| - | -nc, | + | -ma, |
| - | --node <node name> Only events from a specific node | + | -n, |
| - | -p,--pid Pid report | + | -nc, |
| - | -r, | + | --node <node name> |
| - | -s, | + | -p, |
| - | --success only success events in report | + | -r, |
| - | --summary sorted totals for main object in report | + | -s, |
| - | -t,--log Log time range report | + | --success |
| - | -te,--end [end date] [end time] ending date & time for reports | + | --summary |
| - | -tm, | + | -t, |
| - | -ts, | + | -te,--end [end date] [end time] ending date & time for reports |
| - | --tty Report about tty keystrokes | + | -tm, |
| - | -u,--user User name report | + | -ts,--start [start date] [start time] |
| - | -v, | + | --tty |
| - | -x, | + | -u, |
| - | If no report is given, the summary report will be displayed | + | -v, |
| + | | ||
| + | | ||
| + | If no report is given, the summary report will be displayed | ||
| </ | </ | ||
| - | ===La Commande ausearch=== | + | ==La Commande ausearch== |
| - | Cette commande est utilisée pour rechercher des évènements. Par exemple, pour rechercher les évènements | + | Cette commande est utilisée pour rechercher des événements. Par exemple, pour rechercher les événements |
| < | < | ||
| - | root@debian8:~# ausearch -ui 1000 | more | + | root@debian11:~# exit |
| + | logout | ||
| + | trainee@debian11: | ||
| + | Password: fenestros | ||
| + | root@debian11:~# ausearch -ui 1000 | more | ||
| ---- | ---- | ||
| - | time->Wed Oct 28 14:31:30 2015 | + | time->Fri Apr 29 14:31:05 2022 |
| - | type=USER_END msg=audit(1446039090.595:853): pid=1558 uid=1000 auid=1000 ses=2 msg=' | + | type=USER_END msg=audit(1651235465.623:36): pid=45426 uid=1000 auid=1000 ses=142 subj==unconfined |
| - | ose acct=" | + | m_env, |
| ---- | ---- | ||
| - | time->Wed Oct 28 14:31:30 2015 | + | time->Fri Apr 29 14:31:05 2022 |
| - | type=CRED_DISP msg=audit(1446039090.595:854): pid=1558 uid=1000 auid=1000 ses=2 msg=' | + | type=CRED_DISP msg=audit(1651235465.623:37): pid=45426 uid=1000 auid=1000 ses=142 subj==unconfined |
| - | cct=" | + | t=" |
| ---- | ---- | ||
| - | time->Wed Oct 28 14:31:38 2015 | + | time->Fri Apr 29 14:31:11 2022 |
| - | type=USER_AUTH msg=audit(1446039098.083:855): pid=4513 uid=1000 auid=1000 ses=2 msg=' | + | type=USER_AUTH msg=audit(1651235471.067:38): pid=45693 uid=1000 auid=1000 ses=142 subj==unconfined |
| - | ation acct=" | + | tfs acct=" |
| ---- | ---- | ||
| - | time->Wed Oct 28 14:31:46 2015 | + | time->Fri Apr 29 14:31:11 2022 |
| - | type=USER_AUTH | + | type=USER_ACCT |
| - | ation acct=" | + | xe="/usr/ |
| ---- | ---- | ||
| - | time->Wed Oct 28 14:31:46 2015 | + | time->Fri Apr 29 14:31:11 2022 |
| - | type=USER_ACCT | + | type=CRED_ACQ |
| - | g acct=" | + | =" |
| ---- | ---- | ||
| - | time->Wed Oct 28 14:31:46 2015 | + | time->Fri Apr 29 14:31:11 2022 |
| - | type=CRED_ACQ | + | type=USER_START |
| - | --More-- | + | am_env, |
| </ | </ | ||
| - | |||
| - | ==Options de la Commande== | ||
| Les options de cette commande sont : | Les options de cette commande sont : | ||
| < | < | ||
| - | root@debian8:~# ausearch --help | + | root@debian11:~# ausearch --help |
| usage: ausearch [options] | usage: ausearch [options] | ||
| - | -a,--event <Audit event id> | + | |
| - | --arch < | + | --arch < |
| - | -c, | + | -c, |
| - | --checkpoint < | + | --checkpoint < |
| - | --debug Write malformed events that are skipped to stderr | + | --debug |
| - | -e, | + | -e, |
| - | -f, | + | -f, |
| - | -ga, | + | |
| - | -ge, | + | |
| - | group id | + | -ge, |
| - | -gi,--gid <Group Id> search based on group id | + | group id |
| - | -h,--help help | + | -gi,--gid <Group Id> |
| - | -hn,--host <Host Name> search based on remote host name | + | -h, |
| - | -i, | + | -hn,--host <Host Name> |
| - | -if, | + | -i, |
| - | --input-logs Use the logs even if stdin is a pipe | + | -if,--input <Input File name> |
| - | --just-one Emit just one event | + | --input-logs |
| - | -k, | + | --just-one |
| - | -l, --line-buffered Flush output on every line | + | -k, |
| - | -m, | + | -l, --line-buffered |
| - | -n, | + | -m, |
| - | -o, | + | -n, |
| - | -p, | + | -o, |
| - | -pp,--ppid <Parent Process id> | + | -p, |
| - | -r,--raw output is completely unformatted | + | -pp,--ppid <Parent Process id> |
| - | -sc, | + | -r, |
| - | -se, | + | -sc, |
| - | object | + | -se, |
| - | --session <login session id> | + | |
| - | -su, | + | --session <login session id> |
| - | -sv, | + | -su, |
| - | success value | + | -sv, |
| - | -te,--end [end date] [end time] ending date & time for search | + | success value |
| - | -ts, | + | -te,--end [end date] [end time] ending date & time for search |
| - | -tm, | + | -ts,--start [start date] [start time] |
| - | -ua, | + | -tm, |
| - | -ue, | + | -ua, |
| - | user id | + | -ue, |
| - | -ui,--uid <User Id> search based on user id | + | user id |
| - | -ul, | + | -ui,--uid <User Id> |
| - | -uu,--uuid <guest UUID> search for events related to the virtual | + | -ul, |
| - | machine with the given UUID. | + | -uu,--uuid <guest UUID> |
| - | -v, | + | machine with the given UUID. |
| - | -vm, | + | -v, |
| - | machine with the name. | + | -vm, |
| - | -w,--word string matches are whole word | + | machine with the name. |
| - | -x, | + | -w, |
| + | -x, | ||
| </ | </ | ||
| Ligne 691: | Ligne 722: | ||
| Ce fichier contient la plupart des messages du système : | Ce fichier contient la plupart des messages du système : | ||
| - | |||
| < | < | ||
| - | root@debian8:~# tail -n 15 / | + | root@debian11:~# tail -n 15 / |
| - | Oct 28 06:37:21 debian8 | + | Apr 28 06:43:12 debian11 |
| - | Oct 28 06:54:50 debian8 | + | Apr 28 06:43:47 debian11 |
| - | Oct 28 06:54:50 debian8 | + | Apr 28 06:44:00 debian11 |
| - | Oct 28 06:54:51 debian8 kernel: [18359.707784] usb 1-1: New USB device found, idVendor=80ee, | + | Apr 28 16:47:22 debian11 pipewire-media-session[34487]: error id:0 seq:158 res:-32 (Broken pipe): connection error |
| - | Oct 28 06:54:51 debian8 kernel: [18359.707791] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=0 | + | Apr 29 00:00:03 debian11 |
| - | Oct 28 06:54:51 debian8 kernel: [18359.707794] usb 1-1: Product: USB Tablet | + | Apr 29 00:00:03 debian11 |
| - | Oct 28 06:54:51 debian8 | + | Apr 29 14:17:31 debian11 pipewire[45354]: |
| - | Oct 28 06:54:51 debian8 | + | Apr 29 14:17:31 debian11 pipewire[45354]: could not make thread realtime: Permission denied |
| - | Oct 28 06:54:51 debian8 mtp-probe: checking bus 1, device 5: "/ | + | Apr 29 14:17:31 debian11 pipewire-media-session[45364]: could not set nice-level to -11: Permission denied |
| - | Oct 28 06:54:51 debian8 mtp-probe: bus: 1, device: 5 was not an MTP device | + | Apr 29 14:17:31 debian11 pipewire-media-session[45364]: could not make thread realtime: Permission denied |
| - | Oct 28 06:54:51 debian8 kernel: [18359.717846] hid-generic 0003:80EE:0021.0004: input, | + | Apr 29 14:22:13 debian11 pipewire-media-session[45364]: error id:0 seq:158 res:-32 (Broken pipe): connection error |
| - | Oct 28 06:54:51 debian8 kernel: [18359.798364] e1000: eth0 NIC Link is Down | + | Apr 29 14:22:47 debian11 pipewire[45411]: could not set nice-level to -11: Permission denied |
| - | Oct 28 12:30:24 debian8 kernel: [18365.868629] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX | + | Apr 29 14:22:47 debian11 pipewire[45411]: could not make thread realtime: Permission denied |
| - | Oct 28 12:30:24 debian8 kernel: [18365.869262] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready | + | Apr 29 14:22:47 debian11 pipewire-media-session[45423]: could not set nice-level to -11: Permission denied |
| - | Oct 28 14:11:01 debian8 rsyslogd-2007: action ' | + | Apr 29 14:22:47 debian11 pipewire-media-session[45423]: could not make thread realtime: Permission denied |
| </ | </ | ||
| Ligne 721: | Ligne 751: | ||
| < | < | ||
| - | root@debian8:~# ls -l /var/log | + | root@debian11:~# ls -l /var/log |
| - | total 1388 | + | total 1884 |
| - | -rw-r--r-- 1 root root 718 Oct 23 17:09 alternatives.log | + | -rw-r--r-- |
| - | drwxr-xr-x 2 root root | + | drwxr-xr-x |
| - | drwxr-x--- 2 root | + | drwxr-x--- |
| - | -rw-r----- 1 root adm 96160 Oct 28 14:52 auth.log | + | -rw-r----- |
| - | -rw-r----- 1 root | + | -rw------- |
| - | -rw-r--r-- 1 root root 0 Jun 6 17:19 bootstrap.log | + | -rw------- |
| - | -rw------- 1 root utmp 0 Jun 6 17:19 btmp | + | -rw-rw---- 1 root utmp 2304 Apr 29 14:22 btmp |
| - | drwxr-xr-x 2 root root | + | drwxr-xr-x |
| - | -rw-r----- 1 root adm 45007 Oct 28 12:30 daemon.log | + | -rw-r----- |
| - | -rw-r----- 1 root adm 77008 Oct 26 11:22 daemon.log.1 | + | -rw-r----- |
| - | -rw-r----- 1 root adm 9127 Oct 28 06:37 debug | + | -rw-r--r-- |
| - | -rw-r----- 1 root adm 35138 Oct 26 11:22 debug.1 | + | -rw-r--r-- |
| - | -rw-r----- 1 root adm 0 Jun 6 17:19 dmesg | + | -rw-r--r-- |
| - | -rw-r--r-- | + | drwxr-xr-x |
| - | drwxr-s--- 2 Debian-exim | + | drwxr-sr-x+ 3 root |
| - | -rw-r--r-- 1 root root 24024 Oct 23 16:59 faillog | + | -rw-r----- |
| - | -rw-r--r-- 1 root root 0 Jun 6 17:19 fontconfig.log | + | -rw-rw-r-- |
| - | drwxr-xr-x | + | drwx--x--x |
| - | drwxr-xr-x 3 root | + | -rw-r----- |
| - | drwxr-xr-x 3 root root 4096 Oct 23 16:45 installer | + | drwx------ |
| - | -rw-r----- 1 root adm 48698 Oct 28 12:30 kern.log | + | drwxr-xr-x 3 root |
| - | -rw-r----- 1 root adm 180412 Oct 26 11:22 kern.log.1 | + | drwx------ |
| - | -rw-rw-r-- 1 root utmp 292292 | + | -rw-r----- |
| - | drwx--x--x 2 root root | + | -rw-r----- |
| - | -rw-r----- 1 root adm 42656 Oct 28 14:11 messages | + | -rw-rw-r-- |
| - | -rw-r----- 1 root | + | -rw-r--r-- |
| - | drwx------ 2 speech-dispatcher root | + | -rw-r--r-- |
| - | -rw-r----- 1 root adm | + | |
| - | -rw-r----- | + | |
| - | -rw-r----- | + | |
| - | -rw-r----- 1 root adm 10169 Oct 26 11:23 user.log.1 | + | |
| - | -rw-r--r-- 1 root root 1195 Oct 23 16:59 vboxadd-install.log | + | |
| - | -rw-r--r-- 1 root root 73 Oct 23 16:59 vboxadd-install-x11.log | + | |
| - | -rw-r--r-- 1 root root 75 Oct 23 16:59 VBoxGuestAdditions.log | + | |
| - | -rw-rw-r-- 1 root utmp 13440 Oct 26 14:21 wtmp | + | |
| - | -rw-r--r-- 1 root root 29935 Oct 28 06:54 Xorg.0.log | + | |
| - | -rw-r--r-- 1 root root 22097 Oct 26 11:22 Xorg.0.log.old | + | |
| </ | </ | ||
| - | =====rsyslog===== | + | =====LAB #2 - rsyslog===== |
| **rsyslog**, | **rsyslog**, | ||
| Ligne 783: | Ligne 803: | ||
| * transmettre les informations à une application liée à rsyslog via un tube (par exemple, **|logrotate**). | * transmettre les informations à une application liée à rsyslog via un tube (par exemple, **|logrotate**). | ||
| - | Sous Debian, le daemon rsyslog est configuré par l' | + | ====2.1 - Priorités==== |
| - | + | ||
| - | < | + | |
| - | root@debian8: | + | |
| - | # Options for rsyslogd | + | |
| - | # -x disables DNS lookups for remote messages | + | |
| - | # See rsyslogd(8) for more details | + | |
| - | RSYSLOGD_OPTIONS="" | + | |
| - | </ | + | |
| - | + | ||
| - | L' | + | |
| - | + | ||
| - | ^ Directive ^ Version ^ | + | |
| - | | SYSLOGD_OPTIONS="-c 4" | Mode natif - aucune compatibilité | | + | |
| - | | SYSLOGD_OPTIONS=" | + | |
| - | | SYSLOGD_OPTIONS=" | + | |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** : Notez que l' | + | |
| - | </ | + | |
| - | + | ||
| - | ====Priorités==== | + | |
| La **Priorité** permet d' | La **Priorité** permet d' | ||
| Ligne 818: | Ligne 817: | ||
| | 7 | debug | Condition normale - message de débogage | | | 7 | debug | Condition normale - message de débogage | | ||
| - | ====Sous-systèmes applicatifs==== | + | ====2.2 - Sous-systèmes applicatifs==== |
| Le **Sous-système applicatif**, | Le **Sous-système applicatif**, | ||
| Ligne 835: | Ligne 834: | ||
| | local0 - local7 | Réservés pour des utilisations locales | | | local0 - local7 | Réservés pour des utilisations locales | | ||
| - | ====/ | + | ====2.3 - / |
| rsyslog est configuré par le fichier **/ | rsyslog est configuré par le fichier **/ | ||
| < | < | ||
| - | root@debian8:~# cat / | + | root@debian11:~# cat / |
| - | # / | + | # / |
| # | # | ||
| - | # For more information see | + | # For more information |
| - | # / | + | # / |
| Ligne 851: | Ligne 850: | ||
| ################# | ################# | ||
| - | $ModLoad | + | module(load=" |
| - | $ModLoad | + | module(load=" |
| - | #$ModLoad | + | #module(load=" |
| # provides UDP syslog reception | # provides UDP syslog reception | ||
| - | #$ModLoad | + | #module(load=" |
| - | #$UDPServerRun | + | #input(type=" |
| # provides TCP syslog reception | # provides TCP syslog reception | ||
| - | #$ModLoad | + | #module(load=" |
| - | #$InputTCPServerRun | + | #input(type=" |
| Ligne 901: | Ligne 900: | ||
| # First some standard log files. | # First some standard log files. | ||
| # | # | ||
| - | auth, | + | auth, |
| - | *.*; | + | *.*; |
| - | #cron.* / | + | # |
| - | daemon.* -/ | + | daemon.* |
| - | kern.* -/ | + | kern.* |
| - | lpr.* -/ | + | lpr.* |
| - | mail.* -/ | + | mail.* |
| - | user.* -/ | + | user.* |
| # | # | ||
| Ligne 914: | Ligne 913: | ||
| # it is easy to write scripts to parse these files. | # it is easy to write scripts to parse these files. | ||
| # | # | ||
| - | mail.info -/ | + | mail.info |
| - | mail.warn -/ | + | mail.warn |
| - | mail.err / | + | mail.err |
| - | + | ||
| - | # | + | |
| - | # Logging for INN news system. | + | |
| - | # | + | |
| - | news.crit / | + | |
| - | news.err / | + | |
| - | news.notice -/ | + | |
| # | # | ||
| Ligne 929: | Ligne 921: | ||
| # | # | ||
| *.=debug;\ | *.=debug;\ | ||
| - | auth, | + | |
| - | news.none;mail.none -/ | + | mail.none |
| *.=info; | *.=info; | ||
| - | auth, | + | |
| - | cron, | + | cron, |
| - | mail,news.none -/ | + | mail.none |
| # | # | ||
| # Emergencies are sent to everybody logged in. | # Emergencies are sent to everybody logged in. | ||
| # | # | ||
| - | *.emerg :omusrmsg:* | + | *.emerg |
| - | + | ||
| - | # | + | |
| - | # I like to have messages displayed on the console, but only on a virtual | + | |
| - | # console I usually leave idle. | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | # | + | |
| - | + | ||
| - | # The named pipe / | + | |
| - | # you must invoke `xconsole' | + | |
| - | # | + | |
| - | # $ xconsole -file / | + | |
| - | # | + | |
| - | # NOTE: adjust the list below, or you'll go crazy if you have a reasonably | + | |
| - | # busy site.. | + | |
| - | # | + | |
| - | daemon.*; | + | |
| - | news.err; | + | |
| - | *.=debug; | + | |
| - | *.=notice; | + | |
| </ | </ | ||
| Ce fichier est divisé en 3 parties : | Ce fichier est divisé en 3 parties : | ||
| - | * **Modules**, | + | * **MODULES**, |
| * Section traitant le chargement des modules offrant des fonctionnalités étendues à rsyslog, | * Section traitant le chargement des modules offrant des fonctionnalités étendues à rsyslog, | ||
| - | * **Directives Globales** (//Global Directives// | + | * **GLOBAL DIRECTIVES**, |
| * Section traitant les options de comportement global du service rsyslog, | * Section traitant les options de comportement global du service rsyslog, | ||
| - | * **Règles** (//Rules//), | + | * **RULES**, |
| - | * Section traitant les règles de configuration des journaux. Les règles au format syslogd gardent le même format. Les nouvelles règles, compatibles seulement avec rsyslog commencent par **$**. | + | * Section traitant les règles de configuration des journaux. Les règles au format syslogd gardent le même format. Les nouvelles règles, compatibles seulement avec rsyslog commencent par **module**. |
| - | + | ||
| - | <WRAP center round important> | + | |
| - | **Important** : Notez que les versions du fichier **/ | + | |
| - | </ | + | |
| ===Modules=== | ===Modules=== | ||
| Ligne 982: | Ligne 948: | ||
| ^ Module ^ Fonction ^ | ^ Module ^ Fonction ^ | ||
| - | | $ModLoad | + | | module(load=" |
| - | | $ModLoad | + | | module(load=" |
| - | | $ModLoad | + | | module(load=" |
| - | | $ModLoad | + | | module(load=" |
| - | | $ModLoad | + | | module(load=" |
| - | Dans le fichier **/ | + | Dans le fichier **/ |
| < | < | ||
| Ligne 994: | Ligne 960: | ||
| * **#### MODULES #### | * **#### MODULES #### | ||
| - | $ModLoad | + | module(load=" |
| - | $ModLoad | + | module(load=" |
| - | #$ModLoad | + | #module(load=" |
| - | # Provides | + | # provides |
| - | #$ModLoad | + | #module(load=" |
| - | #$UDPServerRun | + | #input(type=" |
| - | # Provides | + | # provides |
| - | #$ModLoad | + | #module(load=" |
| - | #$InputTCPServerRun | + | #input(type=" |
| ... | ... | ||
| </ | </ | ||
| - | Pour activer la réception de messages à partir de serveurs rsyslog distants en utilisant | + | Pour activer la réception de messages à partir de serveurs rsyslog distants en utilisant |
| < | < | ||
| Ligne 1014: | Ligne 980: | ||
| * **#### MODULES #### | * **#### MODULES #### | ||
| - | $ModLoad | + | module(load=" |
| - | $ModLoad | + | module(load=" |
| - | #$ModLoad | + | #module(load=" |
| - | # Provides | + | # provides |
| - | $ModLoad | + | module(load=" |
| - | $UDPServerRun | + | input(type=" |
| - | # Provides | + | # provides |
| - | $ModLoad | + | module(load=" |
| - | $InputTCPServerRun | + | input(type=" |
| ... | ... | ||
| </ | </ | ||
| <WRAP center round important> | <WRAP center round important> | ||
| - | **Important** : Les deux directives **$ModLoad | + | **Important** : Les deux directives **module(load=" |
| </ | </ | ||
| - | Pour envoyer l' | + | Pour envoyer l' |
| < | < | ||
| Ligne 1044: | Ligne 1010: | ||
| # An on-disk queue is created for this action. If the remote host is | # An on-disk queue is created for this action. If the remote host is | ||
| # down, messages are spooled to disk and sent when it is up again. | # down, messages are spooled to disk and sent when it is up again. | ||
| - | $WorkDirectory / | ||
| $ActionQueueFileName fwdRule1 # unique name prefix for spool files | $ActionQueueFileName fwdRule1 # unique name prefix for spool files | ||
| $ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) | $ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) | ||
| Ligne 1051: | Ligne 1016: | ||
| $ActionResumeRetryCount -1 # infinite retries if host is down | $ActionResumeRetryCount -1 # infinite retries if host is down | ||
| # remote host is: name/ | # remote host is: name/ | ||
| - | *.* @@remote-host: | + | # *.* @remote-host: |
| + | *.* @@remote-host: | ||
| # ### end of the forwarding rule ### | # ### end of the forwarding rule ### | ||
| - | ... | ||
| </ | </ | ||
| <WRAP center round important> | <WRAP center round important> | ||
| - | **Important** : Ces directives utilisent le protocole TCP. Le serveur distant doit donc être configuré pour ce mode de communication.La directive ***.* @@remote-host:514** doit être modifiée pour indiquer l' | + | **Important** : La valeur |
| </ | </ | ||
| Ligne 1108: | Ligne 1073: | ||
| </ | </ | ||
| - | =====La Commande logger===== | + | =====LAB #3 - La Commande logger===== |
| La commande **/ | La commande **/ | ||
| Ligne 1121: | Ligne 1086: | ||
| < | < | ||
| - | root@debian8:~# logger -p user.info Linux est super | + | root@debian11:~# logger -p user.info Linux est super |
| </ | </ | ||
| Ligne 1127: | Ligne 1092: | ||
| < | < | ||
| - | root@debian8:~# tail / | + | root@debian11:~# tail / |
| - | Oct 28 15:01:50 debian8 pulseaudio[1278]: Disabling timer-based scheduling because running inside a VM. | + | Apr 29 14:17:31 debian11 pipewire[45354]: could not set nice-level to -11: Permission denied |
| - | Oct 28 15:01:50 debian8 pulseaudio[1278]: Disabling timer-based scheduling because running inside a VM. | + | Apr 29 14:17:31 debian11 pipewire[45354]: could not make thread realtime: Permission denied |
| - | Oct 28 15:01:52 debian8 org.gnome.OnlineAccounts[1245]: goa-daemon-Message: goa-daemon version 3.14.2 starting | + | Apr 29 14:17:31 debian11 pipewire-media-session[45364]: could not set nice-level to -11: Permission denied |
| - | Oct 28 15:01:53 debian8 org.gnome.OnlineAccounts[1245]: (goa-daemon:1318): goa-daemon-CRITICAL **: Error preparing AM: The name org.freedesktop.Telepathy.AccountManager was not provided by any .service files | + | Apr 29 14:17:31 debian11 pipewire-media-session[45364]: could not make thread realtime: Permission denied |
| - | Oct 28 15:01:53 debian8 org.gtk.Private.AfcVolumeMonitor[1245]: Volume monitor alive | + | Apr 29 14:22:13 debian11 pipewire-media-session[45364]: error id:0 seq:158 res:-32 (Broken pipe): connection error |
| - | Oct 28 15:01:57 debian8 vmusr[1368]: [ warning] [vmusr] Error creating backup of old config file. | + | Apr 29 14:22:47 debian11 pipewire[45411]: could not set nice-level to -11: Permission denied |
| - | Oct 28 15:01:57 debian8 vmusr[1368]: [ warning] [vmtoolsd] The vmusr service needs to run inside a virtual machine. | + | Apr 29 14:22:47 debian11 pipewire[45411]: could not make thread realtime: Permission denied |
| - | Oct 28 15:01:59 debian8 org.gnome.zeitgeist.Engine[1245]: ** (zeitgeist-datahub: | + | Apr 29 14:22:47 debian11 pipewire-media-session[45423]: could not set nice-level to -11: Permission denied |
| - | Oct 28 15:08:21 debian8 kernel: [ | + | Apr 29 14:22:47 debian11 pipewire-media-session[45423]: could not make thread realtime: Permission denied |
| - | Oct 28 15:49:23 debian8 | + | Apr 29 15:06:18 debian11 |
| </ | </ | ||
| - | |||
| - | ====Options de la commande==== | ||
| Les options de la commande logger sont : | Les options de la commande logger sont : | ||
| < | < | ||
| - | root@debian8:~# logger --help | + | root@debian11:~# logger --help |
| Usage: | Usage: | ||
| | | ||
| + | |||
| + | Enter messages into the system log. | ||
| Options: | Options: | ||
| - | -T, --tcp use TCP only | + | -i log the logger command' |
| - | -d, --udp use UDP only | + | |
| - | | + | -f, --file < |
| - | -f, --file < | + | -e, --skip-empty |
| - | -n, --server < | + | |
| - | -P, --port < | + | -p, --priority < |
| - | -p, --priority < | + | |
| - | | + | |
| - | -s, --stderr | + | -s, --stderr |
| - | -t, --tag < | + | -S, --size < |
| - | -u, --socket < | + | -t, --tag < |
| + | -n, --server < | ||
| + | -P, --port < | ||
| + | -T, --tcp use TCP only | ||
| + | -d, --udp use UDP only | ||
| + | | ||
| + | | ||
| + | < | ||
| + | | ||
| + | | ||
| + | | ||
| + | -u, --socket < | ||
| + | | ||
| + | print connection errors when using Unix sockets | ||
| | | ||
| - | -h, --help | + | -h, --help |
| - | -V, --version | + | -V, --version |
| For more details see logger(1). | For more details see logger(1). | ||
| </ | </ | ||
| - | + | =====LAB #4 - La Commande logrotate===== | |
| - | =====La Commande logrotate===== | + | |
| Les fichiers journaux grossissent régulièrement. Le programme **/ | Les fichiers journaux grossissent régulièrement. Le programme **/ | ||
| Ligne 1178: | Ligne 1155: | ||
| < | < | ||
| - | root@debian8:~# cat / | + | root@debian11:~# cat / |
| # see "man logrotate" | # see "man logrotate" | ||
| + | |||
| + | # global options do not affect preceding include directives | ||
| + | |||
| # rotate log files weekly | # rotate log files weekly | ||
| weekly | weekly | ||
| Ligne 1188: | Ligne 1168: | ||
| # create new (empty) log files after rotating old ones | # create new (empty) log files after rotating old ones | ||
| create | create | ||
| + | |||
| + | # use date as a suffix of the rotated file | ||
| + | #dateext | ||
| # uncomment this if you want your log files compressed | # uncomment this if you want your log files compressed | ||
| Ligne 1195: | Ligne 1178: | ||
| include / | include / | ||
| - | # no packages own wtmp, or btmp -- we'll rotate them here | + | # system-specific logs may also be configured here. |
| - | / | + | |
| - | missingok | + | |
| - | monthly | + | |
| - | create 0664 root utmp | + | |
| - | rotate 1 | + | |
| - | } | + | |
| - | + | ||
| - | / | + | |
| - | missingok | + | |
| - | monthly | + | |
| - | create 0660 root utmp | + | |
| - | rotate 1 | + | |
| - | } | + | |
| - | + | ||
| - | # system-specific logs may be configured here | + | |
| </ | </ | ||
| Ligne 1220: | Ligne 1188: | ||
| * comprimer les archives créées. | * comprimer les archives créées. | ||
| - | La directive **include / | + | La directive **include / |
| - | La deuxième partie du fichier concerne des configurations spécifiques pour certains fichiers journaux. | + | < |
| + | root@debian11: | ||
| + | total 44 | ||
| + | -rw-r--r-- 1 root root 120 Jan 30 2021 alternatives | ||
| + | -rw-r--r-- 1 root root 173 Jun 10 2021 apt | ||
| + | -rw-r--r-- 1 root root 91 Mar 2 2021 bootlog | ||
| + | -rw-r--r-- 1 root root 130 Oct 14 2019 btmp | ||
| + | -rw-r--r-- 1 root root 181 May 27 2021 cups-daemon | ||
| + | -rw-r--r-- 1 root root 112 Jan 30 2021 dpkg | ||
| + | -rw-r--r-- 1 root root 94 Jan 7 2021 ppp | ||
| + | -rw-r--r-- 1 root root 374 Feb 17 2021 rsyslog | ||
| + | -rw-r--r-- 1 root root 132 Sep 10 2020 sane-utils | ||
| + | -rw-r--r-- 1 root root 677 Sep 15 2021 speech-dispatcher | ||
| + | -rw-r--r-- 1 root root 145 Oct 14 2019 wtmp | ||
| + | </ | ||
| <WRAP center round important> | <WRAP center round important> | ||
| **Important** : Notez que la compression des fichiers de journalisation n'est pas activée par défaut. | **Important** : Notez que la compression des fichiers de journalisation n'est pas activée par défaut. | ||
| </ | </ | ||
| - | |||
| - | ====Options de la commande==== | ||
| Les options de la commande logrotate sont : | Les options de la commande logrotate sont : | ||
| < | < | ||
| - | root@debian8:~# logrotate --help | + | root@debian11:~# logrotate --help |
| Usage: logrotate [OPTION...] < | Usage: logrotate [OPTION...] < | ||
| - | -d, --debug | + | -d, --debug |
| -f, --force | -f, --force | ||
| -m, --mail=command | -m, --mail=command | ||
| -s, --state=statefile | -s, --state=statefile | ||
| + | --skip-state-lock | ||
| -v, --verbose | -v, --verbose | ||
| + | -l, --log=logfile | ||
| --version | --version | ||
| Ligne 1247: | Ligne 1229: | ||
| </ | </ | ||
| - | =====La Journalisation avec journald===== | + | =====LAB #5 - La Journalisation avec journald===== |
| - | Sous Debian | + | Sous Debian |
| < | < | ||
| - | root@debian8:~# ls -l /run/ | + | root@debian11:~# ls -lR /var/ |
| - | total 0 | + | / |
| - | drwxr-s--- 2 root systemd-journal | + | total 4 |
| + | drwxr-sr-x+ 2 root systemd-journal 4096 Apr 25 13:36 6f7e96ef32a74c788166a0f3ad41a5c0 | ||
| + | |||
| + | / | ||
| + | total 32780 | ||
| + | -rw-r-----+ 1 root systemd-journal | ||
| + | -rw-r-----+ 1 root systemd-journal 8388608 Apr 29 15:11 system.journal | ||
| + | -rw-r-----+ 1 root systemd-journal 8388608 Apr 25 13:36 user-1000@0005dd78fd663470-0c9ed794ecc61aa8.journal~ | ||
| + | -rw-r-----+ 1 root systemd-journal 8388608 Apr 29 14:35 user-1000.journal | ||
| </ | </ | ||
| - | A l' | + | Journald ne peut pas envoyer les traces à un autre ordinateur. Pour utiliser un serveur |
| - | + | ||
| - | Pour rendre les journaux permenants, il faut créer | + | |
| < | < | ||
| - | root@debian8:~# mkdir /var/log/journal | + | root@debian11:~# cat /etc/systemd/journald.conf |
| - | root@debian8: | + | # This file is part of systemd. |
| - | total 0 | + | # |
| - | root@debian8: | + | # systemd |
| - | root@debian8: | + | # under the terms of the GNU Lesser General Public License as published by |
| - | ls: cannot access / | + | # the Free Software Foundation; either version 2.1 of the License, |
| - | root@debian8: | + | # (at your option) any later version. |
| - | total 4 | + | # |
| - | drwxr-xr-x 2 root root 4096 Oct 28 15:59 951001cfea0b40279f6ad23a29c19005 | + | # Entries in this file show the compile time defaults. |
| - | root@debian8: | + | # You can change settings by editing this file. |
| + | # Defaults can be restored by simply deleting this file. | ||
| + | # | ||
| + | # See journald.conf(5) for details. | ||
| + | |||
| + | [Journal] | ||
| + | # | ||
| + | # | ||
| + | #Seal=yes | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #TTYPath=/dev/console | ||
| + | # | ||
| + | # | ||
| + | #MaxLevelKMsg=notice | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #Audit=no | ||
| </ | </ | ||
| - | <WRAP center round important> | + | ====5.1 - Consultation des Journaux==== |
| - | **Important** : Journald ne peut pas envoyer les traces à un autre ordinateur. Pour utiliser un serveur de journalisation distant il faut donc inclure la directive **ForwardToSyslog=yes** dans le fichier de configuration de journald, **/ | + | |
| - | </ | + | |
| - | + | ||
| - | ====Consultation des Journaux==== | + | |
| L' | L' | ||
| < | < | ||
| - | root@debian8:~# journalctl | + | root@debian11:~# journalctl |
| - | -- Logs begin at Wed 2015-10-28 14:55:29 CET, end at Wed 2015-10-28 16:01:01 CET. -- | + | -- Journal begins |
| - | Oct 28 14:55:29 debian8 systemd-journal[147]: | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 systemd-journal[147]: | + | Apr 25 07:01:58 debian11 kernel: Command line: BOOT_IMAGE=/ |
| - | Oct 28 14:55:29 debian8 kernel: Initializing cgroup subsys cpuset | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 kernel: Initializing cgroup subsys cpu | + | Apr 25 07:01:58 debian11 kernel: BIOS-provided physical RAM map: |
| - | Oct 28 14:55:29 debian8 kernel: Initializing cgroup subsys cpuacct | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 kernel: BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 kernel: BIOS-e820: [mem 0x0000000100000000-0x000000013fffffff] usable |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 kernel: Hypervisor detected: KVM |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 kernel: kvm-clock: Using msrs 4b564d01 and 4b564d00 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 kernel: kvm-clock: cpu 0, msr 86ab8001, primary cpu clock |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 kernel: kvm-clock: using sched offset of 2324543470279 cycles |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 kernel: clocksource: |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 kernel: tsc: Detected 2399.982 MHz processor |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 kernel: |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 kernel: |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 kernel: MTRR variable ranges |
| - | lines 1-31 | + | Apr 25 07:01:58 debian11 kernel: |
| + | Apr 25 07:01:58 debian11 | ||
| + | Apr 25 07:01:58 debian11 | ||
| + | Apr 25 07:01:58 debian11 kernel: | ||
| + | Apr 25 07:01:58 debian11 | ||
| + | Apr 25 07:01:58 debian11 | ||
| + | Apr 25 07:01:58 debian11 kernel: | ||
| + | Apr 25 07:01:58 debian11 kernel: | ||
| + | Apr 25 07:01:58 debian11 kernel: x86/PAT: Configuration | ||
| + | Apr 25 07:01:58 debian11 | ||
| + | Apr 25 07:01:58 debian11 kernel: found SMP MP-table at [mem 0x000f5a80-0x000f5a8f] | ||
| + | Apr 25 07:01:58 debian11 | ||
| + | Apr 25 07:01:58 debian11 | ||
| + | Apr 25 07:01:58 debian11 kernel: ACPI: RSDP 0x00000000000F5880 000014 (v00 BOCHS ) | ||
| + | Apr 25 07:01:58 debian11 kernel: ACPI: RSDT 0x00000000BFFE145E 000038 (v01 BOCHS BXPCRSDT 00000001 BXPC 00000001) | ||
| + | Apr 25 07:01:58 debian11 | ||
| + | lines 1-47 | ||
| + | [q] | ||
| </ | </ | ||
| Ligne 1322: | Ligne 1358: | ||
| </ | </ | ||
| - | ===Consultation des Journaux d'une Application Spécifique=== | + | ====5.2 - Consultation des Journaux d'une Application Spécifique==== |
| Pour consulter les entrées concernant une application spécifique, | Pour consulter les entrées concernant une application spécifique, | ||
| < | < | ||
| - | root@debian8:~# journalctl / | + | root@debian11:~# journalctl / |
| - | -- Logs begin at Wed 2015-10-28 14:55:29 CET, end at Wed 2015-10-28 16:03:01 CET. -- | + | -- Journal begins |
| - | Oct 28 14:55:36 debian8 | + | Apr 25 07:02:04 debian11 |
| - | Oct 28 14:55:36 debian8 | + | Apr 25 07:02:04 debian11 |
| - | Oct 28 14:55:36 debian8 | + | Apr 25 07:02:04 debian11 anacron[355]: |
| - | Oct 28 15:00:36 debian8 | + | Apr 25 07:02:04 debian11 anacron[355]: |
| - | Oct 28 15:00:36 debian8 | + | Apr 25 07:02:04 debian11 |
| + | -- Boot 7fdaa15ef0664ecb99118b80b4db4cd9 -- | ||
| + | Apr 25 07:08:53 debian11 anacron[361]: | ||
| + | Apr 25 07:08:53 debian11 anacron[361]: | ||
| + | Apr 25 07:08:53 debian11 anacron[361]: | ||
| + | Apr 25 07:08:53 debian11 anacron[361]: | ||
| + | Apr 25 07:08:53 debian11 anacron[361]: | ||
| + | Apr 25 07:13:54 debian11 | ||
| + | Apr 25 07:13:54 debian11 | ||
| + | Apr 25 07:18:53 debian11 anacron[361]: | ||
| + | Apr 25 07:18:53 debian11 anacron[629]: Updated timestamp for job `cron.weekly' to 2022-04-25 | ||
| + | Apr 25 07:18:53 debian11 anacron[361]: | ||
| + | Apr 25 07:23:53 debian11 anacron[361]: | ||
| + | Apr 25 07:23:53 debian11 anacron[361]: | ||
| + | Apr 25 07:23:53 debian11 anacron[361]: | ||
| + | Apr 25 07:34:38 debian11 anacron[649]: | ||
| + | Apr 25 07:34:38 debian11 anacron[649]: | ||
| + | Apr 25 08:30:38 debian11 anacron[677]: | ||
| + | Apr 25 08:30:38 debian11 anacron[677]: | ||
| + | Apr 25 09:31:58 debian11 anacron[708]: | ||
| + | Apr 25 09:31:58 debian11 anacron[708]: | ||
| + | Apr 25 10:32:58 debian11 anacron[739]: | ||
| + | Apr 25 10:32:58 debian11 anacron[739]: | ||
| + | Apr 25 12:34:38 debian11 anacron[799]: | ||
| + | Apr 25 12:34:38 debian11 anacron[799]: | ||
| + | Apr 25 13:34:58 debian11 anacron[828]: | ||
| + | Apr 25 13:34:58 debian11 anacron[828]: | ||
| + | Apr 25 14:33:28 debian11 anacron[8989]: | ||
| + | Apr 25 14:33:28 debian11 anacron[8989]: | ||
| + | Apr 25 15:30:58 debian11 anacron[9035]: | ||
| + | Apr 25 15:30:58 debian11 anacron[9035]: | ||
| + | Apr 25 16:33:28 debian11 anacron[9066]: | ||
| + | Apr 25 16:33:28 debian11 anacron[9066]: | ||
| + | Apr 25 17:32:58 debian11 anacron[9277]: | ||
| + | Apr 25 17:32:58 debian11 anacron[9277]: | ||
| + | Apr 25 18:34:58 debian11 anacron[9307]: | ||
| + | Apr 25 18:34:58 debian11 anacron[9307]: | ||
| + | Apr 25 19:32:38 debian11 anacron[9337]: | ||
| + | Apr 25 19:32:38 debian11 anacron[9337]: | ||
| + | Apr 25 20:32:38 debian11 anacron[9366]: | ||
| + | Apr 25 20:32:38 debian11 anacron[9366]: | ||
| + | Apr 25 21:34:58 debian11 anacron[9396]: | ||
| + | lines 1-47 | ||
| + | [q] | ||
| </ | </ | ||
| <WRAP center round important> | <WRAP center round important> | ||
| - | **Important** : Rappelez-vous que sous RHEL/CentOS 7 le répertoire **/sbin** est un line symbolique vers **/ | + | **Important** : Rappelez-vous que sous Debian 11 le répertoire **/sbin** est un lien symbolique vers **/ |
| </ | </ | ||
| - | ===Consultation des Journaux depuis le Dernier Démarrage=== | + | ====5.3 - Consultation des Journaux depuis le Dernier Démarrage==== |
| Pour consulter les entrées depuis le dernier démarrage, il suffit d' | Pour consulter les entrées depuis le dernier démarrage, il suffit d' | ||
| < | < | ||
| - | root@debian8:~# journalctl -b | more | + | root@debian11:/# journalctl -b | more |
| - | -- Logs begin at Wed 2015-10-28 14:55:29 CET, end at Wed 2015-10-28 16:06:01 CET. -- | + | -- Journal begins |
| - | Oct 28 14:55:29 debian8 systemd-journal[147]: | + | Apr 26 13:08:18 debian11 |
| - | nt limit 20.1M). | + | tils for Debian) 2.35.2) #1 SMP Debian |
| - | Oct 28 14:55:29 debian8 systemd-journal[147]: | + | Apr 26 13:08:18 debian11 |
| - | nt limit 20.1M). | + | Apr 26 13:08:18 debian11 kernel: x86/fpu: x87 FPU will use FXSAVE |
| - | Oct 28 14:55:29 debian8 kernel: Initializing cgroup subsys cpuset | + | Apr 26 13:08:18 debian11 kernel: BIOS-provided physical RAM map: |
| - | Oct 28 14:55:29 debian8 kernel: Initializing cgroup subsys cpu | + | Apr 26 13:08:18 debian11 |
| - | Oct 28 14:55:29 debian8 kernel: Initializing cgroup subsys cpuacct | + | Apr 26 13:08:18 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 |
| - | 16.7-ckt11-1+deb8u5 | + | Apr 26 13:08:18 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 kernel: BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 kernel: BIOS-e820: [mem 0x0000000100000000-0x000000013fffffff] usable |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 kernel: Hypervisor detected: KVM |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 kernel: kvm-clock: Using msrs 4b564d01 and 4b564d00 |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 kernel: kvm-clock: cpu 0, msr 5ccb8001, primary cpu clock |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 kernel: kvm-clock: using sched offset of 10164710878 cycles |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 kernel: clocksource: |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 kernel: tsc: Detected 2399.982 MHz processor |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 kernel: MTRR fixed ranges enabled: |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 kernel: |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 kernel: |
| - | Oct 28 14:55:29 debian8 | + | Apr 26 13:08:18 debian11 kernel: |
| + | Apr 26 13:08:18 debian11 | ||
| + | Apr 26 13:08:18 debian11 kernel: | ||
| + | Apr 26 13:08:18 debian11 kernel: | ||
| + | Apr 26 13:08:18 debian11 kernel: | ||
| + | Apr 26 13:08:18 debian11 | ||
| + | Apr 26 13:08:18 debian11 kernel: | ||
| + | Apr 26 13:08:18 debian11 | ||
| + | Apr 26 13:08:18 debian11 | ||
| + | Apr 26 13:08:18 debian11 kernel: | ||
| + | Apr 26 13:08:18 debian11 kernel: x86/PAT: Configuration | ||
| + | Apr 26 13:08:18 debian11 | ||
| + | Apr 26 13:08:18 debian11 kernel: found SMP MP-table | ||
| + | Apr 26 13:08:18 debian11 | ||
| + | Apr 26 13:08:18 debian11 | ||
| + | Apr 26 13:08:18 debian11 kernel: ACPI: RSDP 0x00000000000F5880 000014 (v00 BOCHS ) | ||
| + | Apr 26 13:08:18 debian11 kernel: ACPI: RSDT 0x00000000BFFE145E 000038 (v01 BOCHS BXPCRSDT 00000001 BXPC 00000001) | ||
| --More-- | --More-- | ||
| + | [q] | ||
| </ | </ | ||
| - | <WRAP center round important> | + | Notez que vous pouvez consulter les messages |
| - | **Important** : Notez que vous pouvez consulter les messages | + | |
| - | </WRAP> | + | < |
| + | root@debian11:/# | ||
| + | -- Journal begins at Mon 2022-04-25 07:01:58 CEST, ends at Fri 2022-04-29 15:17:01 CEST. -- | ||
| + | Apr 25 07:01:58 debian11 kernel: Linux version 5.10.0-13-amd64 (debian-kernel@lists.debian.org) (gcc-10 (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binu | ||
| + | tils for Debian) 2.35.2) #1 SMP Debian 5.10.106-1 (2022-03-17) | ||
| + | Apr 25 07:01:58 debian11 kernel: Command line: BOOT_IMAGE=/ | ||
| + | Apr 25 07:01:58 debian11 kernel: x86/fpu: x87 FPU will use FXSAVE | ||
| + | Apr 25 07:01:58 debian11 kernel: BIOS-provided physical RAM map: | ||
| + | Apr 25 07:01:58 debian11 kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable | ||
| + | Apr 25 07:01:58 debian11 kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved | ||
| + | Apr 25 07:01:58 debian11 kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved | ||
| + | Apr 25 07:01:58 debian11 kernel: BIOS-e820: [mem 0x0000000000100000-0x00000000bffd9fff] usable | ||
| + | Apr 25 07:01:58 debian11 kernel: BIOS-e820: [mem 0x00000000bffda000-0x00000000bfffffff] reserved | ||
| + | Apr 25 07:01:58 debian11 kernel: BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved | ||
| + | Apr 25 07:01:58 debian11 kernel: BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved | ||
| + | Apr 25 07:01:58 debian11 kernel: BIOS-e820: [mem 0x0000000100000000-0x000000013fffffff] usable | ||
| + | Apr 25 07:01:58 debian11 kernel: NX (Execute Disable) protection: active | ||
| + | Apr 25 07:01:58 debian11 kernel: SMBIOS 2.8 present. | ||
| + | Apr 25 07:01:58 debian11 kernel: DMI: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/ | ||
| + | Apr 25 07:01:58 debian11 kernel: Hypervisor detected: KVM | ||
| + | Apr 25 07:01:58 debian11 kernel: kvm-clock: Using msrs 4b564d01 and 4b564d00 | ||
| + | Apr 25 07:01:58 debian11 kernel: kvm-clock: cpu 0, msr 86ab8001, primary cpu clock | ||
| + | Apr 25 07:01:58 debian11 kernel: kvm-clock: using sched offset of 2324543470279 cycles | ||
| + | Apr 25 07:01:58 debian11 kernel: clocksource: | ||
| + | Apr 25 07:01:58 debian11 kernel: tsc: Detected 2399.982 MHz processor | ||
| + | Apr 25 07:01:58 debian11 kernel: e820: update [mem 0x00000000-0x00000fff] usable ==> reserved | ||
| + | Apr 25 07:01:58 debian11 kernel: e820: remove [mem 0x000a0000-0x000fffff] usable | ||
| + | Apr 25 07:01:58 debian11 kernel: last_pfn = 0x140000 max_arch_pfn = 0x400000000 | ||
| + | Apr 25 07:01:58 debian11 kernel: MTRR default type: write-back | ||
| + | Apr 25 07:01:58 debian11 kernel: MTRR fixed ranges enabled: | ||
| + | Apr 25 07:01:58 debian11 kernel: | ||
| + | Apr 25 07:01:58 debian11 kernel: | ||
| + | Apr 25 07:01:58 debian11 kernel: | ||
| + | Apr 25 07:01:58 debian11 kernel: MTRR variable ranges enabled: | ||
| + | Apr 25 07:01:58 debian11 kernel: | ||
| + | Apr 25 07:01:58 debian11 kernel: | ||
| + | Apr 25 07:01:58 debian11 kernel: | ||
| + | Apr 25 07:01:58 debian11 kernel: | ||
| + | Apr 25 07:01:58 debian11 kernel: | ||
| + | Apr 25 07:01:58 debian11 kernel: | ||
| + | Apr 25 07:01:58 debian11 kernel: | ||
| + | Apr 25 07:01:58 debian11 kernel: | ||
| + | Apr 25 07:01:58 debian11 kernel: x86/PAT: Configuration [0-7]: WB WC UC- UC WB WC UC- UC | ||
| + | Apr 25 07:01:58 debian11 kernel: last_pfn = 0xbffda max_arch_pfn = 0x400000000q] | ||
| + | Apr 25 07:01:58 debian11 kernel: found SMP MP-table at [mem 0x000f5a80-0x000f5a8f] | ||
| + | Apr 25 07:01:58 debian11 kernel: RAMDISK: [mem 0x3304d000-0x3581dfff] | ||
| + | Apr 25 07:01:58 debian11 kernel: ACPI: Early table checksum verification disabled | ||
| + | Apr 25 07:01:58 debian11 kernel: ACPI: RSDP 0x00000000000F5880 000014 (v00 BOCHS ) | ||
| + | Apr 25 07:01:58 debian11 kernel: ACPI: RSDT 0x00000000BFFE145E 000038 (v01 BOCHS BXPCRSDT 00000001 BXPC 00000001) | ||
| + | --More-- | ||
| + | [q] | ||
| + | </code> | ||
| - | ===Consultation des Journaux d'une Priorité Spécifique=== | + | ====5.4 - Consultation des Journaux d'une Priorité Spécifique==== |
| Pour consulter les entrées à partir d'une priorité spécifique et supérieur, il suffit d' | Pour consulter les entrées à partir d'une priorité spécifique et supérieur, il suffit d' | ||
| < | < | ||
| - | root@debian8:~# journalctl -p warning | + | root@debian11:/# journalctl -p warning |
| - | -- Logs begin at Wed 2015-10-28 14:55:29 CET, end at Wed 2015-10-28 16:07:01 CET. -- | + | -- Journal begins |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:01:58 debian11 |
| - | Oct 28 14:55:29 debian8 kernel: ACPI: FACP 0x3FFF00F0 0000F4 (v04 VBOX | + | Apr 25 07:01:58 debian11 systemd[1]: / |
| - | Oct 28 14:55:29 debian8 kernel: ACPI: DSDT 0x3FFF0410 001BF1 (v01 VBOX | + | Apr 25 07:02:05 debian11 udisksd[368]: failed to load module mdraid: libbd_mdraid.so.2: cannot open shared object file: No such file or directory |
| - | Oct 28 14:55:29 debian8 kernel: ACPI: FACS 0x3FFF0200 000040 | + | Apr 25 07:02:05 debian11 udisksd[368]: |
| - | Oct 28 14:55:29 debian8 kernel: ACPI: SSDT 0x3FFF0240 0001CC (v01 VBOX | + | Apr 25 07:02:05 debian11 lightdm[408]: Could not enumerate user data directory / |
| - | Oct 28 14:55:29 debian8 kernel: Zone ranges: | + | Apr 25 07:02:05 debian11 NetworkManager[359]: < |
| - | Oct 28 14:55:29 debian8 kernel: DMA | + | Apr 25 07:02:08 debian11 lightdm[485]: Error getting user list from org.freedesktop.Accounts: |
| - | Oct 28 14:55:29 debian8 kernel: Normal | + | Apr 25 07:02:08 debian11 lightdm[408]: Error getting user list from org.freedesktop.Accounts: |
| - | Oct 28 14:55:29 debian8 kernel: HighMem | + | Apr 25 07:02:09 debian11 pulseaudio[505]: Failed to open cookie file '/ |
| - | Oct 28 14:55:29 debian8 kernel: Movable zone start for each node | + | Apr 25 07:02:09 debian11 pulseaudio[505]: Failed to load authentication key '/ |
| - | Oct 28 14:55:29 debian8 kernel: Early memory node ranges | + | Apr 25 07:02:09 debian11 pulseaudio[505]: Failed to open cookie file '/ |
| - | Oct 28 14:55:29 debian8 kernel: node 0: [mem 0x00001000-0x0009efff] | + | Apr 25 07:02:09 debian11 pulseaudio[505]: Failed to load authentication key '/ |
| - | Oct 28 14:55:29 debian8 kernel: node 0: [mem 0x00100000-0x3ffeffff] | + | Apr 25 07:02:09 debian11 pipewire[504]: Failed to receive portal pid: org.freedesktop.DBus.Error.NameHasNoOwner: |
| - | Oct 28 14:55:29 debian8 kernel: Built 1 zonelists in Zone order, mobility grouping on. Total pages: 260258 | + | Apr 25 07:03:23 debian11 lightdm[554]: gkr-pam: unable to locate daemon control file |
| - | Oct 28 14:55:29 debian8 kernel: Memory: 1010236K/1048120K available (4599K kernel code, 518K rwdata, 1448K rodata, 656K init, 460K bss, 37884K reserve | + | Apr 25 07:03:23 debian11 lightdm[554]: Error getting user list from org.freedesktop.Accounts: |
| - | Oct 28 14:55:29 debian8 kernel: Fast TSC calibration using MSR failed | + | Apr 25 07:03:23 debian11 lightdm[408]: g_dbus_connection_call_sync_internal: assertion ' |
| - | Oct 28 14:55:29 debian8 kernel: tsc: Unable | + | Apr 25 07:03:23 debian11 pipewire[574]: Failed to receive portal pid: org.freedesktop.DBus.Error.NameHasNoOwner: |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:03:23 debian11 pulseaudio[575]: Failed to open cookie file '/ |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:03:23 debian11 pulseaudio[575]: Failed to load authentication key '/ |
| - | Oct 28 14:55:29 debian8 kernel: smpboot: weird, boot CPU (#0) not listed by the BIOS | + | Apr 25 07:03:23 debian11 pulseaudio[575]: Failed to open cookie file '/ |
| - | Oct 28 14:55:29 debian8 kernel: NMI watchdog: disabled (cpu0): hardware events not enabled | + | Apr 25 07:03:23 debian11 pulseaudio[575]: Failed to load authentication key '/ |
| - | Oct 28 14:55:29 debian8 kernel: ACPI: Executed 1 blocks of module-level executable AML code | + | Apr 25 07:04:38 debian11 systemd[1]: /lib/ |
| - | Oct 28 14:55:29 debian8 kernel: ACPI Exception: AE_NOT_FOUND, | + | Apr 25 07:04:38 debian11 systemd[1]: / |
| - | Oct 28 14:55:29 debian8 kernel: ACPI Exception: AE_NOT_FOUND, | + | Apr 25 07:04:38 debian11 systemd[1]: / |
| - | Oct 28 14:55:29 debian8 kernel: ACPI Exception: AE_NOT_FOUND, | + | -- Boot 7fdaa15ef0664ecb99118b80b4db4cd9 -- |
| - | Oct 28 14:55:29 debian8 kernel: ACPI Exception: AE_NOT_FOUND, | + | Apr 25 07:08:52 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:08:52 debian11 |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:08:52 debian11 systemd[1]: / |
| - | Oct 28 14:55:29 debian8 | + | Apr 25 07:08:54 debian11 udisksd[388]: failed to load module mdraid: libbd_mdraid.so.2: cannot open shared object file: No such file or directory |
| - | lines 1-31 | + | Apr 25 07:08:54 debian11 lightdm[413]: Error getting user list from org.freedesktop.Accounts: GDBus.Error: |
| + | Apr 25 07:08:54 debian11 udisksd[388]: Failed to load the ' | ||
| + | Apr 25 07:08:54 debian11 NetworkManager[382]: < | ||
| + | Apr 25 07:08:57 debian11 lightdm[491]: Error getting user list from org.freedesktop.Accounts: GDBus.Error: | ||
| + | Apr 25 07:08:58 debian11 pipewire[510]: Failed to receive portal pid: org.freedesktop.DBus.Error.NameHasNoOwner: | ||
| + | Apr 25 13:36:40 debian11 pipewire[850]: | ||
| + | Apr 25 13:36:40 debian11 pipewire[850]: could not make thread realtime: Permission denied | ||
| + | Apr 25 13:36:40 debian11 pipewire[850]: Failed to receive portal pid: org.freedesktop.DBus.Error.NameHasNoOwner: | ||
| + | Apr 25 13:36:40 debian11 pipewire-media-session[856]: | ||
| + | Apr 25 13:36:40 debian11 pipewire-media-session[856]: could not make thread realtime: Permission denied | ||
| + | Apr 25 17:18:37 debian11 pipewire-media-session[856]: error id:0 seq:158 res:-32 (Broken pipe): connection error | ||
| + | -- Boot 7644749265b24b9a8f6a8695c083cfaa -- | ||
| + | Apr 26 13:08:18 debian11 | ||
| + | Apr 26 13:08:18 debian11 | ||
| + | Apr 26 13:08:18 debian11 | ||
| + | Apr 26 13:08:18 debian11 kernel: sd 2:0:0:0: Power-on or device reset occurred | ||
| + | lines 1-47 | ||
| + | [q]q | ||
| </ | </ | ||
| - | ===Consultation des Journaux d'une Plage de Dates ou d' | + | ====5.5 - Consultation des Journaux d'une Plage de Dates ou d' |
| Pour consulter les entrées d'une plage de dates ou d' | Pour consulter les entrées d'une plage de dates ou d' | ||
| < | < | ||
| - | root@debian8:~# journalctl --since | + | root@debian11:/# date |
| - | -- Logs begin at Wed 2015-10-28 14:55:29 CET, end at Wed 2015-10-28 16:08:01 CET. -- | + | Fri 29 Apr 2022 03:22:00 PM CEST |
| - | Oct 28 16:00:01 debian8 CRON[1856]: pam_unix(cron: | + | root@debian11:/ |
| - | Oct 28 16:00:01 debian8 CRON[1857]: (trainee) CMD (/bin/pwd > pwd.txt) | + | -- Journal begins |
| - | Oct 28 16:00:01 debian8 CRON[1856]: pam_unix(cron: | + | Apr 29 15:06:18 debian11 |
| - | Oct 28 16:01:01 debian8 CRON[1861]: pam_unix(cron: | + | Apr 29 15:17:01 debian11 audit[45961]: USER_ACCT pid=45961 |
| - | Oct 28 16:01:01 debian8 CRON[1862]: (trainee) CMD (/ | + | Apr 29 15:17:01 debian11 audit[45961]: CRED_ACQ pid=45961 |
| - | Oct 28 16:01:01 debian8 CRON[1861]: pam_unix(cron: | + | Apr 29 15:17:01 debian11 audit[45961]: USER_START pid=45961 |
| - | Oct 28 16:02:01 debian8 CRON[1870]: pam_unix(cron: | + | Apr 29 15:17:01 debian11 audit[45961]: CRED_DISP pid=45961 |
| - | Oct 28 16:02:01 debian8 CRON[1871]: (trainee) CMD (/ | + | Apr 29 15:17:01 debian11 audit[45961]: USER_END pid=45961 |
| - | Oct 28 16:02:01 debian8 CRON[1870]: pam_unix(cron: | + | Apr 29 15:17:01 debian11 |
| - | Oct 28 16:03:01 debian8 CRON[1877]: pam_unix(cron: | + | Apr 29 15:17:01 debian11 |
| - | Oct 28 16:03:01 debian8 CRON[1878]: (trainee) CMD (/ | + | Apr 29 15:17:01 debian11 |
| - | Oct 28 16:03:01 debian8 CRON[1877]: pam_unix(cron: | + | lines 1-10/ |
| - | Oct 28 16:04:01 debian8 CRON[1885]: pam_unix(cron: | + | [q] |
| - | Oct 28 16:04:01 debian8 CRON[1886]: (trainee) CMD (/ | + | |
| - | Oct 28 16:04:01 debian8 CRON[1885]: pam_unix(cron: | + | |
| - | Oct 28 16:05:01 debian8 CRON[1888]: pam_unix(cron: | + | |
| - | Oct 28 16:05:01 debian8 CRON[1889]: (trainee) CMD (/ | + | |
| - | Oct 28 16:05:01 debian8 | + | |
| - | Oct 28 16:06:01 debian8 CRON[1893]: pam_unix(cron: | + | |
| - | Oct 28 16:06:01 debian8 CRON[1894]: (trainee) CMD (/bin/pwd > pwd.txt) | + | |
| - | Oct 28 16:06:01 debian8 CRON[1893]: pam_unix(cron: | + | |
| - | Oct 28 16:07:01 debian8 CRON[1899]: pam_unix(cron: | + | |
| - | Oct 28 16:07:01 debian8 | + | |
| - | Oct 28 16:07:01 debian8 | + | |
| - | Oct 28 16:08:01 debian8 CRON[1909]: pam_unix(cron: | + | |
| - | Oct 28 16:08:01 debian8 CRON[1910]: (trainee) CMD (/bin/pwd > pwd.txt) | + | |
| - | Oct 28 16:08:01 debian8 CRON[1909]: pam_unix(cron: | + | |
| </ | </ | ||
| <WRAP center round important> | <WRAP center round important> | ||
| - | **Important** : Le format de la date est **2015-09-29 18: | + | **Important** : Il est possible d' |
| </ | </ | ||
| - | ===Consultation des Journaux en Live=== | + | ====5.6 - Consultation des Journaux en Live==== |
| Pour consulter les journaux en live, il suffit d' | Pour consulter les journaux en live, il suffit d' | ||
| < | < | ||
| - | root@debian8:~# journalctl -f | + | root@debian11:/# journalctl -f |
| - | -- Logs begin at Wed 2015-10-28 14:55:29 CET. -- | + | -- Journal begins |
| - | Oct 28 16:06:01 debian8 CRON[1893]: pam_unix(cron:session): session closed for user trainee | + | Apr 29 14:38:42 debian11 systemd[1]: Started Updates mlocate database every day. |
| - | Oct 28 16:07:01 debian8 CRON[1899]: pam_unix(cron: | + | Apr 29 15:06:18 debian11 |
| - | Oct 28 16:07:01 debian8 CRON[1900]: (trainee) CMD (/bin/pwd > pwd.txt) | + | Apr 29 15:17:01 debian11 audit[45961]: USER_ACCT pid=45961 |
| - | Oct 28 16:07:01 debian8 CRON[1899]: pam_unix(cron:session): session closed for user trainee | + | Apr 29 15:17:01 debian11 audit[45961]: CRED_ACQ pid=45961 uid=0 auid=4294967295 ses=4294967295 subj==unconfined msg=' |
| - | Oct 28 16:08:01 debian8 CRON[1909]: pam_unix(cron: | + | Apr 29 15:17:01 debian11 audit[45961]: USER_START pid=45961 uid=0 auid=0 ses=145 subj==unconfined msg=' |
| - | Oct 28 16:08:01 debian8 CRON[1910]: (trainee) CMD (/bin/pwd > pwd.txt) | + | Apr 29 15:17:01 debian11 audit[45961]: CRED_DISP pid=45961 |
| - | Oct 28 16:08:01 debian8 CRON[1909]: pam_unix(cron:session): session closed for user trainee | + | Apr 29 15:17:01 debian11 audit[45961]: USER_END pid=45961 uid=0 auid=0 ses=145 subj==unconfined msg=' |
| - | Oct 28 16:09:01 debian8 | + | Apr 29 15:17:01 debian11 |
| - | Oct 28 16:09:01 debian8 | + | Apr 29 15:17:01 debian11 |
| - | Oct 28 16:09:01 debian8 | + | Apr 29 15:17:01 debian11 |
| + | ^C | ||
| </ | </ | ||
| - | Ouvrez un deuxième terminal et saisissez la commande suivante : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | </ | ||
| - | |||
| - | Retournez consulter le premier terminal : | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | -- Logs begin at Wed 2015-10-28 14:55:29 CET. -- | ||
| - | Oct 28 16:06:01 debian8 CRON[1893]: pam_unix(cron: | ||
| - | Oct 28 16:07:01 debian8 CRON[1899]: pam_unix(cron: | ||
| - | Oct 28 16:07:01 debian8 CRON[1900]: (trainee) CMD (/bin/pwd > pwd.txt) | ||
| - | Oct 28 16:07:01 debian8 CRON[1899]: pam_unix(cron: | ||
| - | Oct 28 16:08:01 debian8 CRON[1909]: pam_unix(cron: | ||
| - | Oct 28 16:08:01 debian8 CRON[1910]: (trainee) CMD (/bin/pwd > pwd.txt) | ||
| - | Oct 28 16:08:01 debian8 CRON[1909]: pam_unix(cron: | ||
| - | Oct 28 16:09:01 debian8 CRON[1914]: pam_unix(cron: | ||
| - | Oct 28 16:09:01 debian8 CRON[1915]: (trainee) CMD (/bin/pwd > pwd.txt) | ||
| - | Oct 28 16:09:01 debian8 CRON[1914]: pam_unix(cron: | ||
| - | Oct 28 16:10:01 debian8 CRON[1922]: pam_unix(cron: | ||
| - | Oct 28 16:10:01 debian8 CRON[1923]: (trainee) CMD (/bin/pwd > pwd.txt) | ||
| - | Oct 28 16:10:01 debian8 CRON[1922]: pam_unix(cron: | ||
| - | Oct 28 16:11:01 debian8 CRON[1927]: pam_unix(cron: | ||
| - | Oct 28 16:11:01 debian8 CRON[1928]: (trainee) CMD (/bin/pwd > pwd.txt) | ||
| - | Oct 28 16:11:01 debian8 CRON[1927]: pam_unix(cron: | ||
| - | Oct 28 16:11:20 debian8 trainee[1936]: | ||
| - | |||
| - | |||
| - | </ | ||
| - | |||
| - | <WRAP center round important> | ||
| - | **Important** : Notez la présence de la dernière ligne. | ||
| - | </ | ||
| - | |||
| - | ===Consultation des Journaux avec des Mots Clefs=== | ||
| - | |||
| - | Pour consulter les mots clefs compris par Journald, tapez la commande journalctl puis appuyer trois fois sur la touche < | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | _AUDIT_LOGINUID= | ||
| - | _AUDIT_SESSION= | ||
| - | _BOOT_ID= | ||
| - | _CMDLINE= | ||
| - | CODE_FILE= | ||
| - | CODE_FUNC= | ||
| - | CODE_LINE= | ||
| - | _COMM= | ||
| - | </ | ||
| - | |||
| - | Pour voir la liste des processus dont les traces sont inclus dans les journaux du mots clefs, tapez la commande journalctl suivi par le nom d'un mot clef puis appuyer deux fois sur la touche < | ||
| - | |||
| - | < | ||
| - | root@debian8: | ||
| - | 0 | ||
| - | root@debian8: | ||
| - | accounts-daemon | ||
| - | anacron | ||
| - | audispd | ||
| - | auditctl | ||
| - | auditd | ||
| - | avahi-daemon | ||
| - | root@debian8: | ||
| - | </ | ||
| - | |||
| - | ----- | ||
| - | < | ||
| - | <div align=" | ||
| - | Copyright © 2020 Hugh Norris.< | ||
| - | </ | ||
| - | </ | ||
| ----- | ----- | ||
| + | Copyright © 2024 Hugh Norris. | ||
