Différences
Ci-dessous, les différences entre deux révisions de la page.
| Les deux révisions précédentesRévision précédenteProchaine révision | Révision précédente | ||
| elearning:workbooks:redhat:rh124:l110 [2024/09/26 11:50] – removed admin | elearning:workbooks:redhat:rh124:l110 [2024/11/28 08:58] (Version actuelle) – admin | ||
|---|---|---|---|
| Ligne 1: | Ligne 1: | ||
| + | ~~PDF: | ||
| + | Version : **2024.01** | ||
| + | |||
| + | Dernière mise-à-jour : ~~LASTMOD~~ | ||
| + | |||
| + | ======RH12411 - Gestion de la Journalisation====== | ||
| + | |||
| + | =====Contenu du Module===== | ||
| + | |||
| + | * **RH12411 - Gestion de la Journalisation** | ||
| + | * Présentation | ||
| + | * La Commande dmesg | ||
| + | * LAB #1 - Surveillance Sécuritaire | ||
| + | * 1.1 - La Commande last | ||
| + | * 1.2 - La Commande lastlog | ||
| + | * 1.3 - La Commande lastb | ||
| + | * 1.4 - Le Fichier / | ||
| + | * 1.5 - Gestion des évènements audit | ||
| + | * Le fichier / | ||
| + | * auditd | ||
| + | * auditctl | ||
| + | * audispd | ||
| + | * La consultation des événements audit | ||
| + | * La Commande aureport | ||
| + | * La Commande ausearch | ||
| + | * Le fichier / | ||
| + | * Applications | ||
| + | * LAB #2 - rsyslog | ||
| + | * 2.1 - Priorités | ||
| + | * 2.2 - Sous-systèmes applicatifs | ||
| + | * 2.3 - / | ||
| + | * Modules | ||
| + | * Directives Globales | ||
| + | * Règles | ||
| + | * Sous-système applicatif.Priorité | ||
| + | * Sous-système applicatif!Priorité | ||
| + | * Sous-système applicatif=Priorité | ||
| + | * L' | ||
| + | * n Sous-systèmes avec la même priorité | ||
| + | * n Sélecteurs avec la même Action | ||
| + | * LAB #3 - La Commande logger | ||
| + | * LAB #4 - La Commande logrotate | ||
| + | * LAB #5 - La Journalisation avec journald | ||
| + | * 5.1 - Consultation des Journaux | ||
| + | * 5.2 - Consultation des Journaux d'une Application Spécifique | ||
| + | * 5.3 - Consultation des Journaux depuis le Dernier Démarrage | ||
| + | * 5.4 - Consultation des Journaux d'une Priorité Spécifique | ||
| + | * 5.5 - Consultation des Journaux d'une Plage de Dates ou d' | ||
| + | * 5.6 - Consultation des Journaux en Live | ||
| + | * 5.7 - Consultation des Journaux avec des Mots Clefs | ||
| + | * LAB #6 - Le Serveur d' | ||
| + | * 6.1 - Introduction | ||
| + | * 6.2 - Le Service chronyd | ||
| + | * 6.2 - Le Fichier / | ||
| + | |||
| + | =====Présentation===== | ||
| + | |||
| + | La majorité des journaux du système et des applications se trouve dans le répertoire **/ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** : Il est conseillé de déplacer le point de montage du répertoire **/ | ||
| + | </ | ||
| + | |||
| + | =====La Commande / | ||
| + | |||
| + | Cette commande retourne les messages du noyau (**//Kernel Ring Buffer//**) stockés dans le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# dmesg | more | ||
| + | [ 0.000000] Linux version 5.14.0-427.37.1.el9_4.x86_64 (mockbuild@x86-64-02.build.eng.rdu2.redhat.com) (gcc (GCC) 11.4.1 20231218 (Red Hat 11.4.1-3), GNU ld version 2.35.2-43.el9) #1 SMP PREEMPT_DYNAMIC Fri | ||
| + | Sep 13 12:41:50 EDT 2024 | ||
| + | [ 0.000000] The list of certified hardware and cloud instances for Red Hat Enterprise Linux 9 can be viewed at the Red Hat Ecosystem Catalog, https:// | ||
| + | [ 0.000000] Command line: BOOT_IMAGE=(hd0, | ||
| + | oot rd.lvm.lv=rhel/ | ||
| + | [ 0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' | ||
| + | [ 0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' | ||
| + | [ 0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' | ||
| + | [ 0.000000] x86/fpu: xstate_offset[2]: | ||
| + | [ 0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using ' | ||
| + | [ 0.000000] signal: max sigframe size: 1776 | ||
| + | [ 0.000000] BIOS-provided physical RAM map: | ||
| + | [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable | ||
| + | [ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved | ||
| + | [ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved | ||
| + | [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000bffd9fff] usable | ||
| + | [ 0.000000] BIOS-e820: [mem 0x00000000bffda000-0x00000000bfffffff] reserved | ||
| + | [ 0.000000] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved | ||
| + | [ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved | ||
| + | [ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000023fffffff] usable | ||
| + | [ 0.000000] NX (Execute Disable) protection: active | ||
| + | [ 0.000000] SMBIOS 2.8 present. | ||
| + | [ 0.000000] DMI: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 | ||
| + | [ 0.000000] Hypervisor detected: KVM | ||
| + | [ 0.000000] kvm-clock: Using msrs 4b564d01 and 4b564d00 | ||
| + | [ 0.000001] kvm-clock: using sched offset of 11342917026 cycles | ||
| + | [ 0.000003] clocksource: | ||
| + | [ 0.000010] tsc: Detected 2099.998 MHz processor | ||
| + | [ 0.001013] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved | ||
| + | [ 0.001016] e820: remove [mem 0x000a0000-0x000fffff] usable | ||
| + | [ 0.001021] last_pfn = 0x240000 max_arch_pfn = 0x400000000 | ||
| + | [ 0.001058] MTRR map: 4 entries (3 fixed + 1 variable; max 19), built from 8 variable MTRRs | ||
| + | [ 0.001061] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT | ||
| + | [ 0.001103] last_pfn = 0xbffda max_arch_pfn = 0x400000000 | ||
| + | [ 0.009594] found SMP MP-table at [mem 0x000f5bc0-0x000f5bcf] | ||
| + | [ 0.009621] Using GB pages for direct mapping | ||
| + | [ 0.009825] RAMDISK: [mem 0x3149c000-0x34a45fff] | ||
| + | [ 0.009836] ACPI: Early table checksum verification disabled | ||
| + | [ 0.009849] ACPI: RSDP 0x00000000000F5980 000014 (v00 BOCHS ) | ||
| + | [ 0.009857] ACPI: RSDT 0x00000000BFFE300C 000038 (v01 BOCHS BXPC | ||
| + | [ 0.009870] ACPI: FACP 0x00000000BFFE2DDE 000074 (v01 BOCHS BXPC | ||
| + | [ 0.009876] ACPI: DSDT 0x00000000BFFDF040 003D9E (v01 BOCHS BXPC | ||
| + | [ 0.009881] ACPI: FACS 0x00000000BFFDF000 000040 | ||
| + | [ 0.009885] ACPI: APIC 0x00000000BFFE2E52 000090 (v01 BOCHS BXPC | ||
| + | [ 0.009889] ACPI: SSDT 0x00000000BFFE2EE2 0000CA (v01 BOCHS VMGENID | ||
| + | [ 0.009893] ACPI: HPET 0x00000000BFFE2FAC 000038 (v01 BOCHS BXPC | ||
| + | [ 0.009898] ACPI: WAET 0x00000000BFFE2FE4 000028 (v01 BOCHS BXPC | ||
| + | [ 0.009901] ACPI: Reserving FACP table memory at [mem 0xbffe2dde-0xbffe2e51] | ||
| + | [ 0.009902] ACPI: Reserving DSDT table memory at [mem 0xbffdf040-0xbffe2ddd] | ||
| + | [ 0.009903] ACPI: Reserving FACS table memory at [mem 0xbffdf000-0xbffdf03f] | ||
| + | [ 0.009904] ACPI: Reserving APIC table memory at [mem 0xbffe2e52-0xbffe2ee1] | ||
| + | [ 0.009905] ACPI: Reserving SSDT table memory at [mem 0xbffe2ee2-0xbffe2fab] | ||
| + | [ 0.009906] ACPI: Reserving HPET table memory at [mem 0xbffe2fac-0xbffe2fe3] | ||
| + | [ 0.009906] ACPI: Reserving WAET table memory at [mem 0xbffe2fe4-0xbffe300b] | ||
| + | [ 0.010241] No NUMA configuration found | ||
| + | --More-- | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | Les option de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# dmesg --help | ||
| + | |||
| + | Usage: | ||
| + | dmesg [options] | ||
| + | |||
| + | Display or control the kernel ring buffer. | ||
| + | |||
| + | Options: | ||
| + | -C, --clear | ||
| + | -c, --read-clear | ||
| + | -D, --console-off | ||
| + | -E, --console-on | ||
| + | -F, --file < | ||
| + | -f, --facility < | ||
| + | -H, --human | ||
| + | -k, --kernel | ||
| + | -L, --color[=< | ||
| + | | ||
| + | -l, --level < | ||
| + | -n, --console-level < | ||
| + | -P, --nopager | ||
| + | -p, --force-prefix | ||
| + | -r, --raw print the raw message buffer | ||
| + | | ||
| + | -S, --syslog | ||
| + | -s, --buffer-size < | ||
| + | -u, --userspace | ||
| + | -w, --follow | ||
| + | -W, --follow-new | ||
| + | -x, --decode | ||
| + | -d, --show-delta | ||
| + | -e, --reltime | ||
| + | -T, --ctime | ||
| + | -t, --notime | ||
| + | | ||
| + | | ||
| + | Suspending/ | ||
| + | | ||
| + | | ||
| + | |||
| + | -h, --help | ||
| + | -V, --version | ||
| + | |||
| + | Supported log facilities: | ||
| + | kern - kernel messages | ||
| + | user - random user-level messages | ||
| + | mail - mail system | ||
| + | daemon - system daemons | ||
| + | auth - security/ | ||
| + | syslog - messages generated internally by syslogd | ||
| + | lpr - line printer subsystem | ||
| + | news - network news subsystem | ||
| + | |||
| + | Supported log levels (priorities): | ||
| + | emerg - system is unusable | ||
| + | alert - action must be taken immediately | ||
| + | crit - critical conditions | ||
| + | err - error conditions | ||
| + | warn - warning conditions | ||
| + | notice - normal but significant condition | ||
| + | info - informational | ||
| + | debug - debug-level messages | ||
| + | |||
| + | For more details see dmesg(1). | ||
| + | </ | ||
| + | |||
| + | =====LAB #1 - Surveillance Sécuritaire===== | ||
| + | |||
| + | ====1.1 - La Commande last==== | ||
| + | |||
| + | Cette commande indique les dates et heures des connexions des utilisateurs à partir du contenu du fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# last | ||
| + | trainee | ||
| + | trainee | ||
| + | trainee | ||
| + | trainee | ||
| + | trainee | ||
| + | trainee | ||
| + | reboot | ||
| + | reboot | ||
| + | trainee | ||
| + | trainee | ||
| + | reboot | ||
| + | trainee | ||
| + | trainee | ||
| + | trainee | ||
| + | reboot | ||
| + | |||
| + | wtmp begins Thu Oct 19 18:27:17 2023 | ||
| + | </ | ||
| + | |||
| + | Les option de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# last --help | ||
| + | |||
| + | Usage: | ||
| + | last [options] [< | ||
| + | |||
| + | Show a listing of last logged in users. | ||
| + | |||
| + | Options: | ||
| + | | ||
| + | -a, --hostlast | ||
| + | -d, --dns translate the IP number back into a hostname | ||
| + | -f, --file < | ||
| + | -F, --fulltimes | ||
| + | -i, --ip | ||
| + | -n, --limit < | ||
| + | -R, --nohostname | ||
| + | -s, --since < | ||
| + | -t, --until < | ||
| + | -p, --present < | ||
| + | -w, --fullnames | ||
| + | -x, --system | ||
| + | | ||
| + | | ||
| + | |||
| + | -h, --help | ||
| + | -V, --version | ||
| + | |||
| + | For more details see last(1). | ||
| + | </ | ||
| + | |||
| + | ====1.2 - La Commande lastlog==== | ||
| + | |||
| + | Cette commande indique les dates et heures de la connexion au système la plus récente des utilisateurs : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# lastlog | ||
| + | Username | ||
| + | root | ||
| + | bin | ||
| + | daemon | ||
| + | adm | ||
| + | lp **Never logged in** | ||
| + | sync **Never logged in** | ||
| + | shutdown | ||
| + | halt **Never logged in** | ||
| + | mail **Never logged in** | ||
| + | operator | ||
| + | games | ||
| + | ftp | ||
| + | nobody | ||
| + | systemd-coredump | ||
| + | dbus **Never logged in** | ||
| + | polkitd | ||
| + | avahi | ||
| + | tss | ||
| + | colord | ||
| + | clevis | ||
| + | rtkit | ||
| + | sssd **Never logged in** | ||
| + | geoclue | ||
| + | libstoragemgmt | ||
| + | systemd-oom | ||
| + | setroubleshoot | ||
| + | pipewire | ||
| + | flatpak | ||
| + | gdm tty1 Thu Sep 26 14:55:01 +0200 2024 | ||
| + | cockpit-ws | ||
| + | cockpit-wsinstance | ||
| + | gnome-initial-setup | ||
| + | sshd **Never logged in** | ||
| + | chrony | ||
| + | dnsmasq | ||
| + | tcpdump | ||
| + | trainee | ||
| + | apache | ||
| + | fenestros2 | ||
| + | fenestros1 | ||
| + | </ | ||
| + | |||
| + | Les option de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# lastlog --help | ||
| + | Usage: lastlog [options] | ||
| + | |||
| + | Options: | ||
| + | -b, --before DAYS print only lastlog records older than DAYS | ||
| + | -C, --clear | ||
| + | -h, --help | ||
| + | -R, --root CHROOT_DIR | ||
| + | -S, --set set lastlog record to current time (usable only with -u) | ||
| + | -t, --time DAYS print only lastlog records more recent than DAYS | ||
| + | -u, --user LOGIN print lastlog record of the specified LOGIN | ||
| + | </ | ||
| + | |||
| + | ====1.3 - La Commande lastb==== | ||
| + | |||
| + | Cette commande indique les dates et heures des connexions infructueuses des utilisateurs à partir du contenu du fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# lastb | ||
| + | root | ||
| + | root | ||
| + | |||
| + | btmp begins Thu Oct 19 18:29:22 2023 | ||
| + | </ | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# lastb --help | ||
| + | |||
| + | Usage: | ||
| + | lastb [options] [< | ||
| + | |||
| + | Show a listing of last logged in users. | ||
| + | |||
| + | Options: | ||
| + | | ||
| + | -a, --hostlast | ||
| + | -d, --dns translate the IP number back into a hostname | ||
| + | -f, --file < | ||
| + | -F, --fulltimes | ||
| + | -i, --ip | ||
| + | -n, --limit < | ||
| + | -R, --nohostname | ||
| + | -s, --since < | ||
| + | -t, --until < | ||
| + | -p, --present < | ||
| + | -w, --fullnames | ||
| + | -x, --system | ||
| + | | ||
| + | | ||
| + | |||
| + | -h, --help | ||
| + | -V, --version | ||
| + | |||
| + | For more details see last(1). | ||
| + | </ | ||
| + | |||
| + | ====1.4 - Le Fichier / | ||
| + | |||
| + | Sous RHEL 9 ce fichier contient la journalisation des opérations de gestion des authentifications : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# tail -n 15 / | ||
| + | Sep 27 14:08:31 redhat9 passwd[10515]: | ||
| + | Sep 27 14:21:40 redhat9 su[10537]: pam_unix(su: | ||
| + | Sep 27 14:21:50 redhat9 su[10537]: pam_unix(su: | ||
| + | Sep 27 14:22:01 redhat9 su[10561]: pam_unix(su-l: | ||
| + | Sep 27 14:23:49 redhat9 su[10561]: pam_unix(su-l: | ||
| + | Sep 27 17:23:32 redhat9 sshd[9392]: Received disconnect from 10.0.2.1 port 37560:11: disconnected by user | ||
| + | Sep 27 17:23:32 redhat9 sshd[9392]: Disconnected from user trainee 10.0.2.1 port 37560 | ||
| + | Sep 27 17:23:32 redhat9 sshd[9357]: pam_unix(sshd: | ||
| + | Sep 27 17:23:32 redhat9 su[10062]: pam_unix(su-l: | ||
| + | Sep 28 08:09:13 redhat9 sshd[11965]: | ||
| + | Sep 28 08:09:13 redhat9 systemd[11972]: | ||
| + | Sep 28 08:09:13 redhat9 sshd[11965]: | ||
| + | Sep 28 08:43:17 redhat9 sshd[12053]: | ||
| + | Sep 28 08:43:17 redhat9 sshd[12053]: | ||
| + | Sep 28 08:43:22 redhat9 su[12102]: pam_unix(su-l: | ||
| + | </ | ||
| + | |||
| + | ====1.5 - Gestion des Evénements audit==== | ||
| + | |||
| + | ===Le fichier / | ||
| + | |||
| + | Ce fichier contient les messages du système d' | ||
| + | |||
| + | * des appels système, | ||
| + | * des accès aux fichiers, | ||
| + | * des informations en provenance de %%SELinux%%. | ||
| + | |||
| + | Consultez maintenant le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# tail -n 15 / | ||
| + | type=CRYPTO_KEY_USER msg=audit(1727528067.947: | ||
| + | type=CRED_ACQ msg=audit(1727528067.948: | ||
| + | type=USER_LOGIN msg=audit(1727528067.994: | ||
| + | type=USER_START msg=audit(1727528067.994: | ||
| + | type=CRYPTO_KEY_USER msg=audit(1727528067.996: | ||
| + | type=BPF msg=audit(1727528068.011: | ||
| + | type=BPF msg=audit(1727528068.011: | ||
| + | type=SERVICE_START msg=audit(1727528068.076: | ||
| + | type=USER_AUTH msg=audit(1727528075.273: | ||
| + | type=USER_ACCT msg=audit(1727528075.276: | ||
| + | type=CRED_ACQ msg=audit(1727528075.277: | ||
| + | type=USER_START msg=audit(1727528075.281: | ||
| + | type=SERVICE_STOP msg=audit(1727528105.326: | ||
| + | type=BPF msg=audit(1727528105.369: | ||
| + | type=BPF msg=audit(1727528105.369: | ||
| + | </ | ||
| + | |||
| + | La gestion des événements audit se repose sur trois exécutables : | ||
| + | |||
| + | ===auditd=== | ||
| + | |||
| + | Cet exécutable est le daemon du système audit. Il est responsable de l’écriture des enregistrements audit sur disque. Son fichier de configuration est le **/ | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# cat / | ||
| + | # | ||
| + | # This file controls the configuration of the audit daemon | ||
| + | # | ||
| + | |||
| + | local_events = yes | ||
| + | write_logs = yes | ||
| + | log_file = / | ||
| + | log_group = root | ||
| + | log_format = ENRICHED | ||
| + | flush = INCREMENTAL_ASYNC | ||
| + | freq = 50 | ||
| + | max_log_file = 8 | ||
| + | num_logs = 5 | ||
| + | priority_boost = 4 | ||
| + | name_format = NONE | ||
| + | ##name = mydomain | ||
| + | max_log_file_action = ROTATE | ||
| + | space_left = 75 | ||
| + | space_left_action = SYSLOG | ||
| + | verify_email = yes | ||
| + | action_mail_acct = root | ||
| + | admin_space_left = 50 | ||
| + | admin_space_left_action = SUSPEND | ||
| + | disk_full_action = SUSPEND | ||
| + | disk_error_action = SUSPEND | ||
| + | use_libwrap = yes | ||
| + | ## | ||
| + | tcp_listen_queue = 5 | ||
| + | tcp_max_per_addr = 1 | ||
| + | ## | ||
| + | tcp_client_max_idle = 0 | ||
| + | transport = TCP | ||
| + | krb5_principal = auditd | ||
| + | ## | ||
| + | distribute_network = no | ||
| + | q_depth = 2000 | ||
| + | overflow_action = SYSLOG | ||
| + | max_restarts = 10 | ||
| + | plugin_dir = / | ||
| + | end_of_event_timeout = 2 | ||
| + | </ | ||
| + | |||
| + | Les option de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# auditd --help | ||
| + | auditd: unrecognized option ' | ||
| + | Usage: auditd [-f] [-l] [-n] [-s disable|enable|nochange] [-c < | ||
| + | </ | ||
| + | |||
| + | ===auditctl=== | ||
| + | |||
| + | Cet exécutable est utilisé pour configurer les règles du système audit. Au démarrage, auditctl lit et applique les règles contunues dans le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# cat / | ||
| + | ## This file is automatically generated from / | ||
| + | -D | ||
| + | -b 8192 | ||
| + | -f 1 | ||
| + | --backlog_wait_time 60000 | ||
| + | |||
| + | [root@redhat9 ~]# ls -l / | ||
| + | total 4 | ||
| + | -rw-------. 1 root root 244 Oct 19 2023 audit.rules | ||
| + | |||
| + | [root@redhat9 ~]# cat / | ||
| + | ## First rule - delete all | ||
| + | -D | ||
| + | |||
| + | ## Increase the buffers to survive stress events. | ||
| + | ## Make this bigger for busy systems | ||
| + | -b 8192 | ||
| + | |||
| + | ## This determine how long to wait in burst of events | ||
| + | --backlog_wait_time 60000 | ||
| + | |||
| + | ## Set failure mode to syslog | ||
| + | -f 1 | ||
| + | |||
| + | </ | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# auditctl -h | ||
| + | usage: auditctl [options] | ||
| + | -a < | ||
| + | -A < | ||
| + | -b < | ||
| + | allowed Default=64 | ||
| + | -c Continue through errors in rules | ||
| + | -C f=f Compare collected fields if available: | ||
| + | Field name, operator(=, | ||
| + | -d < | ||
| + | l=task, | ||
| + | a=never, | ||
| + | -D Delete all rules and watches | ||
| + | -e [0..2] | ||
| + | -f [0..2] | ||
| + | 0=silent 1=printk 2=panic | ||
| + | -F f=v Build rule: field name, operator(=, | ||
| + | > | ||
| + | -h Help | ||
| + | -i Ignore errors when reading rules from file | ||
| + | -k < | ||
| + | -l List rules | ||
| + | -m text Send a user-space message | ||
| + | -p [r|w|x|a] | ||
| + | r=read, w=write, x=execute, a=attribute | ||
| + | -q < | ||
| + | -r < | ||
| + | -R < | ||
| + | -s Report status | ||
| + | -S syscall | ||
| + | --signal < | ||
| + | -t Trim directory watches | ||
| + | -v Version | ||
| + | -w < | ||
| + | -W < | ||
| + | --loginuid-immutable | ||
| + | --backlog_wait_time | ||
| + | --reset-lost | ||
| + | --reset_backlog_wait_time_actual | ||
| + | There was an error while processing parameters | ||
| + | </ | ||
| + | |||
| + | ===La consultation des événements audit=== | ||
| + | |||
| + | La consultation des événements audit se fait en utilisant les commandes **ausearch** et **aureport** : | ||
| + | |||
| + | ==La Commande aureport== | ||
| + | |||
| + | Cette commande est utilisée pour générer des rapports : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# aureport | ||
| + | |||
| + | Summary Report | ||
| + | ====================== | ||
| + | Range of time in logs: 10/19/2023 18: | ||
| + | Selected time for report: 10/19/2023 18:27:19 - 09/28/2024 14: | ||
| + | Number of changes in configuration: | ||
| + | Number of changes to accounts, groups, or roles: 30 | ||
| + | Number of logins: 12 | ||
| + | Number of failed logins: 0 | ||
| + | Number of authentications: | ||
| + | Number of failed authentications: | ||
| + | Number of users: 4 | ||
| + | Number of terminals: 9 | ||
| + | Number of host names: 4 | ||
| + | Number of executables: | ||
| + | Number of commands: 11 | ||
| + | Number of files: 0 | ||
| + | Number of AVC's: 0 | ||
| + | Number of MAC events: 41 | ||
| + | Number of failed syscalls: 0 | ||
| + | Number of anomaly events: 0 | ||
| + | Number of responses to anomaly events: 0 | ||
| + | Number of crypto events: 104 | ||
| + | Number of integrity events: 0 | ||
| + | Number of virt events: 0 | ||
| + | Number of keys: 0 | ||
| + | Number of process IDs: 158 | ||
| + | Number of events: 2567 | ||
| + | </ | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# aureport --help | ||
| + | usage: aureport [options] | ||
| + | -a, | ||
| + | -au, | ||
| + | --comm | ||
| + | -c, | ||
| + | -cr, | ||
| + | --debug | ||
| + | --eoe-timeout secs End of Event Timeout | ||
| + | -e, | ||
| + | --escape option | ||
| + | -f, | ||
| + | --failed | ||
| + | -h, | ||
| + | --help | ||
| + | -i, | ||
| + | -if,--input <Input File name> | ||
| + | --input-logs | ||
| + | --integrity | ||
| + | -k, | ||
| + | -l, | ||
| + | -m, | ||
| + | -ma, | ||
| + | -n, | ||
| + | -nc, | ||
| + | --node <node name> | ||
| + | -p, | ||
| + | -r, | ||
| + | -s, | ||
| + | --success | ||
| + | --summary | ||
| + | -t, | ||
| + | -te,--end [end date] [end time] ending date & time for reports | ||
| + | -tm, | ||
| + | -ts,--start [start date] [start time] | ||
| + | --tty | ||
| + | -u, | ||
| + | -v, | ||
| + | --virt | ||
| + | -x, | ||
| + | If no report is given, the summary report will be displayed | ||
| + | </ | ||
| + | |||
| + | ==La Commande ausearch== | ||
| + | |||
| + | Cette commande est utilisée pour rechercher des événements. Par exemple, pour rechercher les événements liés à un utilisateur représenté par son UID : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# ausearch -ui 1000 | more | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_AUTH msg=audit(1697732960.285: | ||
| + | tname=? addr=? terminal=/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_AUTH msg=audit(1697732971.707: | ||
| + | su" hostname=? addr=? terminal=/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_ACCT msg=audit(1697732971.746: | ||
| + | "/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=CRED_ACQ msg=audit(1697732971.747: | ||
| + | name=? addr=? terminal=/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_START msg=audit(1697732971.835: | ||
| + | am_systemd, | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_AUTH msg=audit(1697733321.865: | ||
| + | su" hostname=? addr=? terminal=/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_ACCT msg=audit(1697733321.905: | ||
| + | "/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=CRED_ACQ msg=audit(1697733321.905: | ||
| + | name=? addr=? terminal=/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_START msg=audit(1697733321.909: | ||
| + | am_systemd, | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_END msg=audit(1697733340.703: | ||
| + | m_systemd, | ||
| + | ---- | ||
| + | time-> | ||
| + | type=CRED_DISP msg=audit(1697733340.704: | ||
| + | tname=? addr=? terminal=/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_AUTH msg=audit(1727252106.538: | ||
| + | su" hostname=? addr=? terminal=/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=USER_ACCT msg=audit(1727252106.579: | ||
| + | "/ | ||
| + | ---- | ||
| + | time-> | ||
| + | type=CRED_ACQ msg=audit(1727252106.579: | ||
| + | --More-- | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | Les options de cette commande sont : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# ausearch --help | ||
| + | usage: ausearch [options] | ||
| + | -a,--event <Audit event id> | ||
| + | --arch < | ||
| + | -c, | ||
| + | --checkpoint < | ||
| + | --debug | ||
| + | -e, | ||
| + | -escape < | ||
| + | --eoe-timeout secs End of Event timeout | ||
| + | --extra-keys | ||
| + | --extra-labels | ||
| + | --extra-obj2 | ||
| + | --extra-time | ||
| + | -f, | ||
| + | --format [raw|default|interpret|csv|text] results format options | ||
| + | -ga, | ||
| + | -ge, | ||
| + | group id | ||
| + | -gi,--gid <Group Id> | ||
| + | -h, | ||
| + | -hn,--host <Host Name> | ||
| + | -i, | ||
| + | -if,--input <Input File name> | ||
| + | --input-logs | ||
| + | --just-one | ||
| + | -k, | ||
| + | -l, --line-buffered | ||
| + | -m, | ||
| + | -n, | ||
| + | -o, | ||
| + | -p, | ||
| + | -pp,--ppid <Parent Process id> | ||
| + | -r, | ||
| + | -sc, | ||
| + | -se, | ||
| + | | ||
| + | --session <login session id> | ||
| + | -su, | ||
| + | -sv, | ||
| + | success value | ||
| + | -te,--end [end date] [end time] ending date & time for search | ||
| + | -ts,--start [start date] [start time] | ||
| + | -tm, | ||
| + | -ua, | ||
| + | -ue, | ||
| + | user id | ||
| + | -ui,--uid <User Id> | ||
| + | -ul, | ||
| + | -uu,--uuid <guest UUID> | ||
| + | machine with the given UUID. | ||
| + | -v, | ||
| + | -vm, | ||
| + | machine with the name. | ||
| + | -w, | ||
| + | -x, | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** : Pour plus d' | ||
| + | </ | ||
| + | |||
| + | =====Le fichier / | ||
| + | |||
| + | Ce fichier contient la plupart des messages du système : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# tail -n 15 / | ||
| + | Sep 28 13:33:57 redhat9 systemd[1]: dnf-makecache.service: | ||
| + | Sep 28 13:35:04 redhat9 cupsd[5736]: | ||
| + | Sep 28 14:33:24 redhat9 cupsd[5736]: | ||
| + | Sep 28 14:54:27 redhat9 systemd-logind[5671]: | ||
| + | Sep 28 14:54:27 redhat9 systemd[1]: Started Session 14 of User trainee. | ||
| + | Sep 28 14:54:28 redhat9 systemd[1]: Starting Hostname Service... | ||
| + | Sep 28 14:54:28 redhat9 systemd[1]: Started Hostname Service. | ||
| + | Sep 28 14:54:35 redhat9 su[12662]: (to root) trainee on pts/1 | ||
| + | Sep 28 14:55:05 redhat9 systemd[1]: systemd-hostnamed.service: | ||
| + | Sep 28 14:57:20 redhat9 systemd[1]: Starting Cleanup of Temporary Directories... | ||
| + | Sep 28 14:57:20 redhat9 systemd[1]: systemd-tmpfiles-clean.service: | ||
| + | Sep 28 14:57:20 redhat9 systemd[1]: Finished Cleanup of Temporary Directories. | ||
| + | Sep 28 14:57:20 redhat9 systemd[1]: run-credentials-systemd\x2dtmpfiles\x2dclean.service.mount: | ||
| + | Sep 28 15:02:37 redhat9 systemd[5851]: | ||
| + | Sep 28 15:02:37 redhat9 systemd[5851]: | ||
| + | </ | ||
| + | |||
| + | =====Applications===== | ||
| + | |||
| + | Certaines applications consignent leurs journaux dans des répertoires spécifiques. Par exemple : | ||
| + | |||
| + | * cups, | ||
| + | * httpd, | ||
| + | * samba, | ||
| + | * ... | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# ls -l /var/log | ||
| + | total 1952 | ||
| + | drwxr-xr-x. 2 root | ||
| + | drwx------. 2 root | ||
| + | -rw-------. 1 root | ||
| + | -rw-------. 1 root | ||
| + | -rw-rw----. 1 root | ||
| + | drwxr-x---. 2 chrony chrony | ||
| + | -rw-------. 1 root | ||
| + | drwxr-xr-x. 2 lp | ||
| + | -rw-r--r--. 1 root | ||
| + | -rw-r--r--. 1 root | ||
| + | -rw-r--r--. 1 root | ||
| + | -rw-r-----. 1 root | ||
| + | drwx--x--x. 2 root | ||
| + | -rw-r--r--. 1 root | ||
| + | drwx------. 2 root | ||
| + | drwx------. 2 root | ||
| + | -rw-------. 1 root | ||
| + | -rw-rw-r--. 1 root | ||
| + | -rw-------. 1 root | ||
| + | -rw-------. 1 root | ||
| + | drwx------. 2 root | ||
| + | drwxr-xr-x. 2 root | ||
| + | lrwxrwxrwx. 1 root | ||
| + | drwxr-xr-x. 2 root | ||
| + | drwx------. 3 root | ||
| + | -rw-------. 1 root | ||
| + | drwx------. 2 root | ||
| + | -rw-------. 1 root | ||
| + | drwxr-x---. 2 sssd | ||
| + | -rw-------. 1 root | ||
| + | drwxr-xr-x. 2 root | ||
| + | -rw-rw-r--. 1 root | ||
| + | </ | ||
| + | |||
| + | =====LAB #2 - rsyslog===== | ||
| + | |||
| + | **rsyslog**, | ||
| + | |||
| + | rsyslog apporte des améliorations par rapport à syslogd : | ||
| + | |||
| + | * l' | ||
| + | * la haute disponibilité, | ||
| + | * l' | ||
| + | |||
| + | Les messages de journalisation envoyés à rsyslog sont marqués avec un **Sous-système applicatif** et une **Priorité**. Le binôme Sous-système applicatif/ | ||
| + | |||
| + | rsyslog décide ensuite de l' | ||
| + | |||
| + | * ignorer les informations, | ||
| + | * envoyer les informations à un rsyslog sur une autre machine (par exemple, **@machine2**), | ||
| + | * inscrire les informations dans un fichier sur disque (par exemple, **/ | ||
| + | * transmettre les informations à un utilisateur (par exemple **root**), | ||
| + | * transmettre les informations à tous les utilisateurs (par exemple *****), | ||
| + | * transmettre les informations à une application liée à rsyslog via un tube (par exemple, **|logrotate**). | ||
| + | |||
| + | Sous RHEL 9, le daemon rsyslog est configuré par l' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# cat / | ||
| + | # Options for rsyslogd | ||
| + | # Syslogd options are deprecated since rsyslog v3. | ||
| + | # If you want to use them, switch to compatibility mode 2 by "-c 2" | ||
| + | # See rsyslogd(8) for more details | ||
| + | SYSLOGD_OPTIONS="" | ||
| + | </ | ||
| + | |||
| + | L' | ||
| + | |||
| + | ^ Directive ^ Version ^ | ||
| + | | SYSLOGD_OPTIONS=" | ||
| + | | SYSLOGD_OPTIONS=" | ||
| + | | SYSLOGD_OPTIONS=" | ||
| + | |||
| + | ====2.1 - Priorités==== | ||
| + | |||
| + | La **Priorité** permet d' | ||
| + | |||
| + | ^ Niveau ^ Priorité ^ Description ^ | ||
| + | | 0 | emerg/panic | Système inutilisable | | ||
| + | | 1 | alert | Action immédiate requise | | ||
| + | | 2 | crit | Condition critique atteinte | | ||
| + | | 3 | err/error | Erreurs rencontrées | | ||
| + | | 4 | warning/ | ||
| + | | 5 | notice | Condition normale - message important | | ||
| + | | 6 | info | Condition normale - message simple | | ||
| + | | 7 | debug | Condition normale - message de débogage | | ||
| + | |||
| + | ====2.2 - Sous-systèmes applicatifs==== | ||
| + | |||
| + | Le **Sous-système applicatif**, | ||
| + | |||
| + | ^ Fonction ^ Description ^ | ||
| + | | auth/ | ||
| + | | cron | Message de cron ou at | | ||
| + | | daemon | Message d'un daemon | | ||
| + | | kern | Message du noyau | | ||
| + | | lpr | Message du système d' | ||
| + | | mail | Message du système de mail | | ||
| + | | news | Message du système de news | | ||
| + | | syslog | Message interne de rsyslogd | | ||
| + | | user | Message utilisateur | | ||
| + | | uucp | Message du système UUCP | | ||
| + | | local0 - local7 | Réservés pour des utilisations locales | | ||
| + | |||
| + | |||
| + | ====2.3 - / | ||
| + | |||
| + | rsyslog est configuré par le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# cat / | ||
| + | # rsyslog configuration file | ||
| + | |||
| + | # For more information see / | ||
| + | # or latest version online at http:// | ||
| + | # If you experience problems, see http:// | ||
| + | |||
| + | #### GLOBAL DIRECTIVES #### | ||
| + | |||
| + | # Where to place auxiliary files | ||
| + | global(workDirectory="/ | ||
| + | |||
| + | # Use default timestamp format | ||
| + | module(load=" | ||
| + | |||
| + | #### MODULES #### | ||
| + | |||
| + | module(load=" | ||
| + | | ||
| + | # local messages are retrieved through imjournal now. | ||
| + | module(load=" | ||
| + | | ||
| + | | ||
| + | | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Include all config files in / | ||
| + | include(file="/ | ||
| + | |||
| + | # Provides UDP syslog reception | ||
| + | # for parameters see http:// | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Provides TCP syslog reception | ||
| + | # for parameters see http:// | ||
| + | # | ||
| + | # | ||
| + | |||
| + | #### RULES #### | ||
| + | |||
| + | # Log all kernel messages to the console. | ||
| + | # Logging much else clutters up the screen. | ||
| + | # | ||
| + | |||
| + | # Log anything (except mail) of level info or higher. | ||
| + | # Don't log private authentication messages! | ||
| + | *.info; | ||
| + | |||
| + | # The authpriv file has restricted access. | ||
| + | authpriv.* | ||
| + | |||
| + | # Log all the mail messages in one place. | ||
| + | mail.* | ||
| + | |||
| + | |||
| + | # Log cron stuff | ||
| + | cron.* | ||
| + | |||
| + | # Everybody gets emergency messages | ||
| + | *.emerg | ||
| + | |||
| + | # Save news errors of level crit and higher in a special file. | ||
| + | uucp, | ||
| + | |||
| + | # Save boot messages also to boot.log | ||
| + | local7.* | ||
| + | |||
| + | |||
| + | # ### sample forwarding rule ### | ||
| + | # | ||
| + | # # An on-disk queue is created for this action. If the remote host is | ||
| + | # # down, messages are spooled to disk and sent when it is up again. | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # # Remote Logging (we use TCP for reliable delivery) | ||
| + | # # remote_host is: name/ip, e.g. 192.168.0.1, | ||
| + | # | ||
| + | </ | ||
| + | |||
| + | Ce fichier est divisé en 3 parties : | ||
| + | |||
| + | * **Modules**, | ||
| + | * Section traitant le chargement des modules offrant des fonctionnalités étendues à rsyslog, | ||
| + | * **Directives Globales** (//Global Directives// | ||
| + | * Section traitant les options de comportement global du service rsyslog, | ||
| + | * **Règles** (// | ||
| + | * Section traitant les règles de configuration des journaux. Les règles au format syslogd gardent le même format. Les nouvelles règles, compatibles seulement avec rsyslog commencent par **module**. | ||
| + | |||
| + | ===Modules=== | ||
| + | |||
| + | Depuis la version 3 de rsyslog, la réception des données par ce dernier appelée les **inputs** est gérée par l' | ||
| + | |||
| + | ^ Module ^ Fonction ^ | ||
| + | | module(load=" | ||
| + | | module(load=" | ||
| + | | module(load=" | ||
| + | | module(load=" | ||
| + | | module(load=" | ||
| + | | module(load=" | ||
| + | |||
| + | Dans le fichier **/ | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | #### MODULES #### | ||
| + | |||
| + | module(load=" | ||
| + | | ||
| + | # local messages are retrieved through imjournal now. | ||
| + | module(load=" | ||
| + | | ||
| + | | ||
| + | | ||
| + | # | ||
| + | # | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Pour activer la réception de messages à partir de serveurs rsyslog distants en utilisant le protocole **UDP**, il convient de décommenter les directives de chargement de modules dans le fichier **/ | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | # Provides UDP syslog reception | ||
| + | # for parameters see http:// | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Provides TCP syslog reception | ||
| + | # for parameters see http:// | ||
| + | # | ||
| + | # | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** : Les deux directives **module(load=" | ||
| + | </ | ||
| + | |||
| + | Pour envoyer l' | ||
| + | |||
| + | < | ||
| + | ... | ||
| + | # ### sample forwarding rule ### | ||
| + | # | ||
| + | # # An on-disk queue is created for this action. If the remote host is | ||
| + | # # down, messages are spooled to disk and sent when it is up again. | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # # Remote Logging (we use TCP for reliable delivery) | ||
| + | # # remote_host is: name/ip, e.g. 192.168.0.1, | ||
| + | # | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** : Ces directives utilisent le protocole TCP. Le serveur distant doit donc être configuré pour ce mode de communication. La directive **Target=" | ||
| + | </ | ||
| + | |||
| + | ===Directives Globales=== | ||
| + | |||
| + | Les directives dans cette section servent à configurer le comportement de rsyslog. Par exemple, nous pouvons constater la présence de la directive suivante : | ||
| + | |||
| + | < | ||
| + | module(load=" | ||
| + | </ | ||
| + | |||
| + | Cette directive stipule que le format des entrées dans les fichiers de journalisation **ne doit pas** être au format d' | ||
| + | |||
| + | ===Règles=== | ||
| + | |||
| + | Chaque règle prend la forme suivante : | ||
| + | |||
| + | < | ||
| + | Sélecteur[; | ||
| + | </ | ||
| + | |||
| + | Un Sélecteur est défini d'une des façons suivantes : | ||
| + | |||
| + | ==Sous-système applicatif.Priorité== | ||
| + | |||
| + | Dans ce cas on ne tient compte que des messages de priorité égale ou supérieure à la Priorité indiquée. | ||
| + | |||
| + | ==Sous-système applicatif!Priorité== | ||
| + | |||
| + | Dans ce cas on ne tient compte que des messages de priorité inférieure à la Priorité indiquée. | ||
| + | |||
| + | ==Sous-système applicatif=Priorité== | ||
| + | |||
| + | Dans ce cas on ne tient compte que des messages de priorité égale à la Priorité indiquée. | ||
| + | |||
| + | ==L' | ||
| + | |||
| + | La valeur du Sous-système applicatif et/ou de la Priorité peut également être *****. Dans ce cas, toutes les valeurs possibles du **Sous-système applicatif** et/ou de la **Priorité** sont concernées, | ||
| + | |||
| + | ==n Sous-systèmes avec la même priorité== | ||
| + | |||
| + | Plusieurs Sous-systèmes applicatifs peuvent être stipulés pour la même Priorité en les séparant avec un **virgule**. Par exemple : **uucp, | ||
| + | |||
| + | ==n Sélecteurs avec la même Action== | ||
| + | |||
| + | Une Action peut s' | ||
| + | |||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** : Une Action précédée par le signe **-** est entreprise d'une manière **asynchrone**. Dans le cas ou l' | ||
| + | </ | ||
| + | |||
| + | =====LAB #3 - La Commande logger===== | ||
| + | |||
| + | La commande **/ | ||
| + | |||
| + | La syntaxe de la commande est : | ||
| + | |||
| + | < | ||
| + | logger -p Sous-système applicatif.Priorité message | ||
| + | </ | ||
| + | |||
| + | Par exemple saisissez la commande suivante : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# logger -p user.info Linux est super | ||
| + | </ | ||
| + | |||
| + | Consultez la fin de votre syslog : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# tail / | ||
| + | Sep 28 15:05:26 redhat9 dnf[12735]: Extra Packages for Enterprise Linux 9 openh264 | ||
| + | Sep 28 15:05:26 redhat9 dnf[12735]: Extra Packages for Enterprise Linux 9 - Next - 199 kB/s | 26 kB 00:00 | ||
| + | Sep 28 15:05:27 redhat9 dnf[12735]: Red Hat Enterprise Linux 9 for x86_64 - AppStre | ||
| + | Sep 28 15:05:27 redhat9 dnf[12735]: Red Hat Enterprise Linux 9 for x86_64 - BaseOS | ||
| + | Sep 28 15:05:28 redhat9 dnf[12735]: Red Hat CodeReady Linux Builder for RHEL 9 x86_ 34 kB/s | 4.5 kB 00:00 | ||
| + | Sep 28 15:05:28 redhat9 dnf[12735]: Metadata cache created. | ||
| + | Sep 28 15:05:28 redhat9 systemd[1]: dnf-makecache.service: | ||
| + | Sep 28 15:05:28 redhat9 systemd[1]: Finished dnf makecache. | ||
| + | Sep 28 15:05:28 redhat9 systemd[1]: dnf-makecache.service: | ||
| + | Sep 28 15:15:29 redhat9 root[12751]: | ||
| + | </ | ||
| + | |||
| + | Les options de la commande logger sont : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# logger --help | ||
| + | |||
| + | Usage: | ||
| + | | ||
| + | |||
| + | Enter messages into the system log. | ||
| + | |||
| + | Options: | ||
| + | | ||
| + | | ||
| + | -f, --file < | ||
| + | -e, --skip-empty | ||
| + | | ||
| + | -p, --priority < | ||
| + | | ||
| + | | ||
| + | -s, --stderr | ||
| + | -S, --size < | ||
| + | -t, --tag < | ||
| + | -n, --server < | ||
| + | -P, --port < | ||
| + | -T, --tcp use TCP only | ||
| + | -d, --udp use UDP only | ||
| + | | ||
| + | | ||
| + | < | ||
| + | | ||
| + | | ||
| + | | ||
| + | -u, --socket < | ||
| + | | ||
| + | print connection errors when using Unix sockets | ||
| + | | ||
| + | |||
| + | -h, --help | ||
| + | -V, --version | ||
| + | |||
| + | For more details see logger(1). | ||
| + | </ | ||
| + | |||
| + | =====LAB #4 - La Commande logrotate===== | ||
| + | |||
| + | Les fichiers journaux grossissent régulièrement. Le programme **/ | ||
| + | |||
| + | Visualisez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# cat / | ||
| + | # see "man logrotate" | ||
| + | |||
| + | # global options do not affect preceding include directives | ||
| + | |||
| + | # rotate log files weekly | ||
| + | weekly | ||
| + | |||
| + | # keep 4 weeks worth of backlogs | ||
| + | rotate 4 | ||
| + | |||
| + | # create new (empty) log files after rotating old ones | ||
| + | create | ||
| + | |||
| + | # use date as a suffix of the rotated file | ||
| + | dateext | ||
| + | |||
| + | # uncomment this if you want your log files compressed | ||
| + | #compress | ||
| + | |||
| + | # packages drop log rotation information into this directory | ||
| + | include / | ||
| + | |||
| + | # system-specific logs may be also be configured here. | ||
| + | </ | ||
| + | |||
| + | Dans la première partie de ce fichier on trouve des directives pour : | ||
| + | |||
| + | * remplacer les fichiers journaux chaque semaine | ||
| + | * garder 4 archives des fichiers journaux | ||
| + | * créer un nouveau fichier log une fois le précédent archivé | ||
| + | * comprimer les archives créées. | ||
| + | |||
| + | La directive **include / | ||
| + | |||
| + | La deuxième partie du fichier concerne des configurations spécifiques pour certains fichiers journaux. | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** : Notez que la compression des fichiers de journalisation n'est pas activée par défaut. | ||
| + | </ | ||
| + | |||
| + | Les options de la commande logrotate sont : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# logrotate --help | ||
| + | Usage: logrotate [OPTION...] < | ||
| + | -d, --debug | ||
| + | -f, --force | ||
| + | -m, --mail=command | ||
| + | -s, --state=statefile | ||
| + | --skip-state-lock | ||
| + | -v, --verbose | ||
| + | -l, --log=logfile | ||
| + | --version | ||
| + | |||
| + | Help options: | ||
| + | -?, --help | ||
| + | --usage | ||
| + | </ | ||
| + | |||
| + | =====LAB #5 - La Journalisation avec journald===== | ||
| + | |||
| + | Sous RHEL 9, les fichiers de Syslog sont gardés pour une question de compatibilité. Cependant, tous les journaux sont d' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# ls -l / | ||
| + | total 0 | ||
| + | drwxr-s---+ 2 root systemd-journal 60 Sep 25 12:44 5a35a3eb625c45cea1d33535723e791f | ||
| + | </ | ||
| + | |||
| + | A l' | ||
| + | |||
| + | La configuration de ce comportement se trouve dans le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# cat / | ||
| + | # This file is part of systemd. | ||
| + | # | ||
| + | # systemd is free software; you can redistribute it and/or modify it under the | ||
| + | # terms of the GNU Lesser General Public License as published by the Free | ||
| + | # Software Foundation; either version 2.1 of the License, or (at your option) | ||
| + | # any later version. | ||
| + | # | ||
| + | # Entries in this file show the compile time defaults. Local configuration | ||
| + | # should be created by either modifying this file, or by creating " | ||
| + | # the journald.conf.d/ | ||
| + | # Defaults can be restored by simply deleting this file and all drop-ins. | ||
| + | # | ||
| + | # Use ' | ||
| + | # | ||
| + | # See journald.conf(5) for details. | ||
| + | |||
| + | [Journal] | ||
| + | # | ||
| + | # | ||
| + | #Seal=yes | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | Audit= | ||
| + | </ | ||
| + | |||
| + | La valeur de la variable peut être : | ||
| + | |||
| + | * **auto** - si le répertoire **/ | ||
| + | * **persistent** - le journal est persistant et est stocké dans le répertoire **/ | ||
| + | * **volatile** - le journal est stocké dans un fichier dynamique dans le répertoire **/ | ||
| + | |||
| + | Pour rendre le journal permenant, modifiez le fichier **/ | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# vi / | ||
| + | [root@redhat9 ~]# cat / | ||
| + | # This file is part of systemd. | ||
| + | # | ||
| + | # systemd is free software; you can redistribute it and/or modify it under the | ||
| + | # terms of the GNU Lesser General Public License as published by the Free | ||
| + | # Software Foundation; either version 2.1 of the License, or (at your option) | ||
| + | # any later version. | ||
| + | # | ||
| + | # Entries in this file show the compile time defaults. Local configuration | ||
| + | # should be created by either modifying this file, or by creating " | ||
| + | # the journald.conf.d/ | ||
| + | # Defaults can be restored by simply deleting this file and all drop-ins. | ||
| + | # | ||
| + | # Use ' | ||
| + | # | ||
| + | # See journald.conf(5) for details. | ||
| + | |||
| + | [Journal] | ||
| + | Storage=auto | ||
| + | # | ||
| + | #Seal=yes | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | Audit= | ||
| + | </ | ||
| + | |||
| + | Créez le répertoire **/ | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# mkdir / | ||
| + | [root@redhat9 ~]# ls -l / | ||
| + | total 0 | ||
| + | </ | ||
| + | |||
| + | Redémarrez votre VM : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# reboot | ||
| + | [root@redhat9 ~]# Connection to 10.0.2.101 closed by remote host. | ||
| + | Connection to 10.0.2.101 closed. | ||
| + | </ | ||
| + | |||
| + | Reconnectez-vous à votre VM : | ||
| + | |||
| + | < | ||
| + | [trainee@redhat9 ~]$ su - | ||
| + | Password: fenestros | ||
| + | |||
| + | [root@redhat9 ~]# ls -l / | ||
| + | total 0 | ||
| + | |||
| + | [root@redhat9 ~]# ls -l / | ||
| + | total 0 | ||
| + | drwxr-sr-x+ 2 root systemd-journal 53 Sep 28 15:39 5a35a3eb625c45cea1d33535723e791f | ||
| + | </ | ||
| + | |||
| + | Journald ne peut pas envoyer de traces à un autre ordinateur. Pour utiliser un serveur de journalisation distant il faut donc ajouter la directive **ForwardToSyslog=yes** au fichier de configuration de journald, **/ | ||
| + | |||
| + | ====5.1 - Consultation des Journaux==== | ||
| + | |||
| + | L' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# journalctl | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Linux version 5.14.0-427.37.1.el9_4.x86_64 (mockbuild@x86-64-02.build.eng.rdu2.redhat.com) (gcc (GCC) 11.4.1 20231218 (Red Hat 11.4.1-3), GNU ld version 2.35.2-43> | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: The list of certified hardware and cloud instances for Red Hat Enterprise Linux 9 can be viewed at the Red Hat Ecosystem Catalog, https:// | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Command line: BOOT_IMAGE=(hd0, | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: xstate_offset[2]: | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using ' | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: signal: max sigframe size: 1776 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-provided physical RAM map: | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x0000000000100000-0x00000000bffd9fff] usable | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x00000000bffda000-0x00000000bfffffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x0000000100000000-0x000000023fffffff] usable | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: NX (Execute Disable) protection: active | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: SMBIOS 2.8 present. | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: DMI: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Hypervisor detected: KVM | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: kvm-clock: Using msrs 4b564d01 and 4b564d00 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: kvm-clock: using sched offset of 269552729537899 cycles | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: clocksource: | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: tsc: Detected 2099.998 MHz processor | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: e820: update [mem 0x00000000-0x00000fff] usable ==> reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: e820: remove [mem 0x000a0000-0x000fffff] usable | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: last_pfn = 0x240000 max_arch_pfn = 0x400000000 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: MTRR map: 4 entries (3 fixed + 1 variable; max 19), built from 8 variable MTRRs | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: last_pfn = 0xbffda max_arch_pfn = 0x400000000 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: found SMP MP-table at [mem 0x000f5bc0-0x000f5bcf] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Using GB pages for direct mapping | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: RAMDISK: [mem 0x3149c000-0x34a45fff] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Early table checksum verification disabled | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: RSDP 0x00000000000F5980 000014 (v00 BOCHS ) | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: RSDT 0x00000000BFFE300C 000038 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: FACP 0x00000000BFFE2DDE 000074 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: DSDT 0x00000000BFFDF040 003D9E (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: FACS 0x00000000BFFDF000 000040 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: APIC 0x00000000BFFE2E52 000090 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: SSDT 0x00000000BFFE2EE2 0000CA (v01 BOCHS VMGENID | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: HPET 0x00000000BFFE2FAC 000038 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: WAET 0x00000000BFFE2FE4 000028 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving FACP table memory at [mem 0xbffe2dde-0xbffe2e51] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving DSDT table memory at [mem 0xbffdf040-0xbffe2ddd] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving FACS table memory at [mem 0xbffdf000-0xbffdf03f] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving APIC table memory at [mem 0xbffe2e52-0xbffe2ee1] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving SSDT table memory at [mem 0xbffe2ee2-0xbffe2fab] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving HPET table memory at [mem 0xbffe2fac-0xbffe2fe3] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving WAET table memory at [mem 0xbffe2fe4-0xbffe300b] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: No NUMA configuration found | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Faking a node at [mem 0x0000000000000000-0x000000023fffffff] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: NODE_DATA(0) allocated [mem 0x23ffd5000-0x23fffffff] | ||
| + | lines 1-55 | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** : Notez que les messages importants sont en gras, par exemple les messages de niveaux **notice** ou **warning** et que les messages graves sont en rouge. | ||
| + | </ | ||
| + | |||
| + | ====5.2 - Consultation des Journaux d'une Application Spécifique==== | ||
| + | |||
| + | Pour consulter les entrées concernant une application spécifique, | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# journalctl /sbin/crond | ||
| + | Sep 28 15:37:18 redhat9.ittraining.loc crond[1138]: | ||
| + | Sep 28 15:37:18 redhat9.ittraining.loc crond[1138]: | ||
| + | Sep 28 15:37:18 redhat9.ittraining.loc crond[1138]: | ||
| + | Sep 28 15:37:18 redhat9.ittraining.loc crond[1138]: | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** : Rappelez-vous que sous RHEL9 le répertoire **/sbin** est un lien symbolique vers **/ | ||
| + | </ | ||
| + | |||
| + | ====5.3 - Consultation des Journaux depuis le Dernier Démarrage==== | ||
| + | |||
| + | Pour consulter les entrées depuis le dernier démarrage, il suffit d' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# journalctl -b | more | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Linux version 5.14.0-427.37.1.el9_4.x86_64 (mockbuild@x86-64-02.build.eng.rdu2.redhat.com) (gcc (GCC) 11.4.1 20231218 (Red Hat 11.4.1-3), GNU ld version 2.35.2-43. | ||
| + | el9) #1 SMP PREEMPT_DYNAMIC Fri Sep 13 12:41:50 EDT 2024 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: The list of certified hardware and cloud instances for Red Hat Enterprise Linux 9 can be viewed at the Red Hat Ecosystem Catalog, https:// | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Command line: BOOT_IMAGE=(hd0, | ||
| + | apper/ | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: xstate_offset[2]: | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using ' | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: signal: max sigframe size: 1776 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-provided physical RAM map: | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x0000000000100000-0x00000000bffd9fff] usable | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x00000000bffda000-0x00000000bfffffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x0000000100000000-0x000000023fffffff] usable | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: NX (Execute Disable) protection: active | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: SMBIOS 2.8 present. | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: DMI: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Hypervisor detected: KVM | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: kvm-clock: Using msrs 4b564d01 and 4b564d00 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: kvm-clock: using sched offset of 269552729537899 cycles | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: clocksource: | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: tsc: Detected 2099.998 MHz processor | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: e820: update [mem 0x00000000-0x00000fff] usable ==> reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: e820: remove [mem 0x000a0000-0x000fffff] usable | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: last_pfn = 0x240000 max_arch_pfn = 0x400000000 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: MTRR map: 4 entries (3 fixed + 1 variable; max 19), built from 8 variable MTRRs | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: last_pfn = 0xbffda max_arch_pfn = 0x400000000 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: found SMP MP-table at [mem 0x000f5bc0-0x000f5bcf] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Using GB pages for direct mapping | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: RAMDISK: [mem 0x3149c000-0x34a45fff] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Early table checksum verification disabled | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: RSDP 0x00000000000F5980 000014 (v00 BOCHS ) | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: RSDT 0x00000000BFFE300C 000038 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: FACP 0x00000000BFFE2DDE 000074 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: DSDT 0x00000000BFFDF040 003D9E (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: FACS 0x00000000BFFDF000 000040 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: APIC 0x00000000BFFE2E52 000090 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: SSDT 0x00000000BFFE2EE2 0000CA (v01 BOCHS VMGENID | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: HPET 0x00000000BFFE2FAC 000038 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: WAET 0x00000000BFFE2FE4 000028 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving FACP table memory at [mem 0xbffe2dde-0xbffe2e51] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving DSDT table memory at [mem 0xbffdf040-0xbffe2ddd] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving FACS table memory at [mem 0xbffdf000-0xbffdf03f] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving APIC table memory at [mem 0xbffe2e52-0xbffe2ee1] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving SSDT table memory at [mem 0xbffe2ee2-0xbffe2fab] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving HPET table memory at [mem 0xbffe2fac-0xbffe2fe3] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving WAET table memory at [mem 0xbffe2fe4-0xbffe300b] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: No NUMA configuration found | ||
| + | --More-- | ||
| + | [q] | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** : Notez que vous pouvez consulter les messages des démarrages précédents, | ||
| + | </ | ||
| + | |||
| + | ====5.4 - Consultation des Journaux d'une Priorité Spécifique==== | ||
| + | |||
| + | Pour consulter les entrées à partir d'une priorité spécifique et supérieur, il suffit d' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# journalctl -p warning | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: acpi PNP0A03:00: fail to add MMCONFIG information, | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: device-mapper: | ||
| + | Sep 28 15:37:00 redhat9.ittraining.loc systemd[1]: sys-module-fuse.device: | ||
| + | Sep 28 15:37:00 redhat9.ittraining.loc kernel: sd 0:0:0:0: Power-on or device reset occurred | ||
| + | Sep 28 15:37:10 redhat9.ittraining.loc lvm[696]: PV /dev/sda2 online, VG rhel is complete. | ||
| + | Sep 28 15:37:12 redhat9.ittraining.loc avahi-daemon[752]: | ||
| + | Sep 28 15:37:16 redhat9.ittraining.loc kernel: Warning: Unmaintained driver is detected: ip_set | ||
| + | Sep 28 15:37:20 redhat9.ittraining.loc kernel: block dm-0: the capability attribute has been deprecated. | ||
| + | Sep 28 15:37:23 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:23 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:23 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:23 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:23 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:23 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:23 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:23 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:23 redhat9.ittraining.loc org.gnome.Shell.desktop[1802]: | ||
| + | Sep 28 15:37:23 redhat9.ittraining.loc org.gnome.Shell.desktop[1802]: | ||
| + | Sep 28 15:37:25 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:25 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:27 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:27 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:27 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:27 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:28 redhat9.ittraining.loc wireplumber[1859]: | ||
| + | Sep 28 15:37:28 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:28 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:28 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:28 redhat9.ittraining.loc wireplumber[1859]: | ||
| + | Sep 28 15:37:28 redhat9.ittraining.loc gnome-shell[1802]: | ||
| + | Sep 28 15:37:28 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:28 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:28 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:28 redhat9.ittraining.loc gsd-sharing[1908]: | ||
| + | Sep 28 15:37:28 redhat9.ittraining.loc gsd-sharing[1908]: | ||
| + | Sep 28 15:37:28 redhat9.ittraining.loc gsd-sharing[1908]: | ||
| + | Sep 28 15:37:28 redhat9.ittraining.loc org.gnome.Shell.desktop[1831]: | ||
| + | Sep 28 15:37:28 redhat9.ittraining.loc gnome-shell[1802]: | ||
| + | Sep 28 15:37:29 redhat9.ittraining.loc dbus-broker[751]: | ||
| + | Sep 28 15:37:29 redhat9.ittraining.loc dbus-broker[751]: | ||
| + | Sep 28 15:37:29 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:30 redhat9.ittraining.loc gnome-shell[1802]: | ||
| + | Sep 28 15:37:30 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:30 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:30 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:30 redhat9.ittraining.loc gsd-media-keys[1923]: | ||
| + | Sep 28 15:37:30 redhat9.ittraining.loc gsd-media-keys[1923]: | ||
| + | Sep 28 15:37:30 redhat9.ittraining.loc org.gnome.Shell.desktop[2153]: | ||
| + | Sep 28 15:37:30 redhat9.ittraining.loc org.gnome.Shell.desktop[2153]: | ||
| + | Sep 28 15:37:30 redhat9.ittraining.loc org.gnome.Shell.desktop[2153]: | ||
| + | Sep 28 15:37:30 redhat9.ittraining.loc org.gnome.Shell.desktop[2153]: | ||
| + | Sep 28 15:37:30 redhat9.ittraining.loc / | ||
| + | Sep 28 15:37:30 redhat9.ittraining.loc / | ||
| + | Sep 28 15:39:43 redhat9.ittraining.loc / | ||
| + | lines 1-55 | ||
| + | </ | ||
| + | |||
| + | Les priorités reconnues par Journald sont : | ||
| + | |||
| + | ^ Niveau ^ Priorité ^ Description ^ | ||
| + | | 0 | emerg | Système inutilisable | | ||
| + | | 1 | alert | Action immédiate requise | | ||
| + | | 2 | crit | Condition critique atteinte | | ||
| + | | 3 | err | Erreurs rencontrées | | ||
| + | | 4 | warning | Avertissements présentés | | ||
| + | | 5 | notice | Condition normale - message important | | ||
| + | | 6 | info | Condition normale - message simple | | ||
| + | | 7 | debug | Condition normale - message de débogage | | ||
| + | |||
| + | ====5.5 - Consultation des Journaux d'une Plage de Dates ou d' | ||
| + | |||
| + | Pour consulter les entrées d'une plage de dates ou d' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# journalctl --since 03:45 --until now | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Linux version 5.14.0-427.37.1.el9_4.x86_64 (mockbuild@x86-64-02.build.eng.rdu2.redhat.com) (gcc (GCC) 11.4.1 20231218 (Red Hat 11.4.1-3), GNU ld version 2.35.2-43> | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: The list of certified hardware and cloud instances for Red Hat Enterprise Linux 9 can be viewed at the Red Hat Ecosystem Catalog, https:// | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Command line: BOOT_IMAGE=(hd0, | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers' | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers' | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers' | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: xstate_offset[2]: | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using ' | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: signal: max sigframe size: 1776 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-provided physical RAM map: | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x0000000000100000-0x00000000bffd9fff] usable | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x00000000bffda000-0x00000000bfffffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: BIOS-e820: [mem 0x0000000100000000-0x000000023fffffff] usable | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: NX (Execute Disable) protection: active | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: SMBIOS 2.8 present. | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: DMI: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Hypervisor detected: KVM | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: kvm-clock: Using msrs 4b564d01 and 4b564d00 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: kvm-clock: using sched offset of 269552729537899 cycles | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: clocksource: | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: tsc: Detected 2099.998 MHz processor | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: e820: update [mem 0x00000000-0x00000fff] usable ==> reserved | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: e820: remove [mem 0x000a0000-0x000fffff] usable | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: last_pfn = 0x240000 max_arch_pfn = 0x400000000 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: MTRR map: 4 entries (3 fixed + 1 variable; max 19), built from 8 variable MTRRs | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: last_pfn = 0xbffda max_arch_pfn = 0x400000000 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: found SMP MP-table at [mem 0x000f5bc0-0x000f5bcf] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Using GB pages for direct mapping | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: RAMDISK: [mem 0x3149c000-0x34a45fff] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Early table checksum verification disabled | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: RSDP 0x00000000000F5980 000014 (v00 BOCHS ) | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: RSDT 0x00000000BFFE300C 000038 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: FACP 0x00000000BFFE2DDE 000074 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: DSDT 0x00000000BFFDF040 003D9E (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: FACS 0x00000000BFFDF000 000040 | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: APIC 0x00000000BFFE2E52 000090 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: SSDT 0x00000000BFFE2EE2 0000CA (v01 BOCHS VMGENID | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: HPET 0x00000000BFFE2FAC 000038 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: WAET 0x00000000BFFE2FE4 000028 (v01 BOCHS BXPC | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving FACP table memory at [mem 0xbffe2dde-0xbffe2e51] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving DSDT table memory at [mem 0xbffdf040-0xbffe2ddd] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving FACS table memory at [mem 0xbffdf000-0xbffdf03f] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving APIC table memory at [mem 0xbffe2e52-0xbffe2ee1] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving SSDT table memory at [mem 0xbffe2ee2-0xbffe2fab] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving HPET table memory at [mem 0xbffe2fac-0xbffe2fe3] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: ACPI: Reserving WAET table memory at [mem 0xbffe2fe4-0xbffe300b] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: No NUMA configuration found | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Faking a node at [mem 0x0000000000000000-0x000000023fffffff] | ||
| + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: NODE_DATA(0) allocated [mem 0x23ffd5000-0x23fffffff] | ||
| + | lines 1-55 | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important 60%> | ||
| + | **Important** : Il est possible d' | ||
| + | </ | ||
| + | |||
| + | ====5.6 - Consultation des Journaux en Live==== | ||
| + | |||
| + | Pour consulter les journaux en live, il suffit d' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# journalctl -f | ||
| + | Sep 28 15:41:02 redhat9.ittraining.loc systemd[2200]: | ||
| + | Sep 28 15:41:03 redhat9.ittraining.loc systemd[2200]: | ||
| + | Sep 28 15:42:29 redhat9.ittraining.loc PackageKit[1886]: | ||
| + | Sep 28 15:42:29 redhat9.ittraining.loc systemd[1]: packagekit.service: | ||
| + | Sep 28 15:43:02 redhat9.ittraining.loc systemd[1340]: | ||
| + | Sep 28 15:43:02 redhat9.ittraining.loc systemd[1340]: | ||
| + | Sep 28 15:43:02 redhat9.ittraining.loc systemd[1340]: | ||
| + | Sep 28 15:44:02 redhat9.ittraining.loc systemd[2200]: | ||
| + | Sep 28 15:44:02 redhat9.ittraining.loc systemd[2200]: | ||
| + | Sep 28 15:44:02 redhat9.ittraining.loc systemd[2200]: | ||
| + | ^C | ||
| + | </ | ||
| + | |||
| + | ====5.7 - Consultation des Journaux avec des Mots Clefs=== | ||
| + | |||
| + | Pour consulter les mots clefs compris par Journald, tapez la commande **journalctl** puis appuyer **deux** fois sur la touche < | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# journalctl | ||
| + | _AUDIT_LOGINUID= | ||
| + | _AUDIT_SESSION= | ||
| + | AVAILABLE= | ||
| + | AVAILABLE_PRETTY= | ||
| + | _BOOT_ID= | ||
| + | _CAP_EFFECTIVE= | ||
| + | _CMDLINE= | ||
| + | CODE_FILE= | ||
| + | CODE_FUNC= | ||
| + | CODE_LINE= | ||
| + | _COMM= | ||
| + | CURRENT_USE= | ||
| + | CURRENT_USE_PRETTY= | ||
| + | DBUS_BROKER_LOG_DROPPED= | ||
| + | DBUS_BROKER_MESSAGE_DESTINATION= | ||
| + | DBUS_BROKER_MESSAGE_INTERFACE= | ||
| + | DBUS_BROKER_MESSAGE_MEMBER= | ||
| + | DBUS_BROKER_MESSAGE_PATH= | ||
| + | DBUS_BROKER_MESSAGE_SERIAL= | ||
| + | DBUS_BROKER_MESSAGE_SIGNATURE= | ||
| + | </ | ||
| + | |||
| + | Pour voir la liste des processus dont les traces sont inclus dans les journaux du mots clefs, tapez la commande journalctl suivi par le nom d'un mot clef puis appuyer deux fois sur la touche < | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# journalctl _UID= | ||
| + | 0 | ||
| + | |||
| + | [root@redhat9 ~]# journalctl _COMM= | ||
| + | accounts-daemon | ||
| + | at-spi2-registr | ||
| + | auditctl | ||
| + | auditd | ||
| + | augenrules | ||
| + | </ | ||
| + | |||
| + | =====LAB #6 - Le Serveur d' | ||
| + | |||
| + | ====6.1 - Introduction==== | ||
| + | |||
| + | Dans le cas d'un serveur de réseau, il est souvent important de maintenir l' | ||
| + | |||
| + | Le protocole utilisé s' | ||
| + | |||
| + | <WRAP center round important> | ||
| + | **Important** - La commande **ntpdate**, | ||
| + | </ | ||
| + | |||
| + | Linux utilise le fuseau d' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# ls -l / | ||
| + | lrwxrwxrwx. 1 root root 34 Oct 19 2023 / | ||
| + | </ | ||
| + | |||
| + | Ce fichier peut être un fichier ordinaire ou bien un lien symbolique pointant vers un de sfichiers dans le répertoire **/ | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# ls / | ||
| + | Africa | ||
| + | America | ||
| + | Antarctica | ||
| + | Arctic | ||
| + | </ | ||
| + | |||
| + | Pour connaître le fuseau d' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# date | ||
| + | Sat Sep 28 03:55:32 PM CEST 2024 | ||
| + | </ | ||
| + | |||
| + | <WRAP center round important> | ||
| + | **Important** - Vous pouvez consulter la liste des codes des zones à l' | ||
| + | </ | ||
| + | |||
| + | Le fuseau d' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# timedatectl | ||
| + | Local time: Sat 2024-09-28 15:57:01 CEST | ||
| + | | ||
| + | RTC time: Sat 2024-09-28 13:57:01 | ||
| + | Time zone: Europe/ | ||
| + | System clock synchronized: | ||
| + | NTP service: inactive | ||
| + | RTC in local TZ: no | ||
| + | </ | ||
| + | |||
| + | La commande **timedatectl** peut être utilisée pour modifier le fuseau d' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# timedatectl set-timezone America/ | ||
| + | |||
| + | [root@redhat9 ~]# timedatectl | ||
| + | Local time: Sat 2024-09-28 07:05:43 MST | ||
| + | | ||
| + | RTC time: Sat 2024-09-28 14:05:43 | ||
| + | Time zone: America/ | ||
| + | System clock synchronized: | ||
| + | NTP service: inactive | ||
| + | RTC in local TZ: no | ||
| + | |||
| + | [root@redhat9 ~]# timedatectl set-timezone Europe/ | ||
| + | [root@redhat9 ~]# timedatectl | ||
| + | Local time: Sat 2024-09-28 16:06:35 CEST | ||
| + | | ||
| + | RTC time: Sat 2024-09-28 14:06:35 | ||
| + | Time zone: Europe/ | ||
| + | System clock synchronized: | ||
| + | NTP service: inactive | ||
| + | RTC in local TZ: no | ||
| + | </ | ||
| + | |||
| + | L' | ||
| + | |||
| + | Vous pouvez aussi modifier le fuseau d' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# tzselect | ||
| + | Please identify a location so that time zone rules can be set correctly. | ||
| + | Please select a continent, ocean, " | ||
| + | 1) Africa | ||
| + | 2) Americas | ||
| + | 3) Antarctica | ||
| + | 4) Asia 8) Indian Ocean | ||
| + | #? ^C | ||
| + | </ | ||
| + | |||
| + | Il est est possible de modifier le fuseau d' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# date | ||
| + | Sat Sep 28 03:59:46 PM CEST 2024 | ||
| + | [root@redhat9 ~]# export TZ=:/ | ||
| + | [root@redhat9 ~]# date | ||
| + | Sat Sep 28 02:59:54 PM BST 2024 | ||
| + | [root@redhat9 ~]# export TZ=:/ | ||
| + | [root@redhat9 ~]# date | ||
| + | Sat Sep 28 04:00:06 PM CEST 2024 | ||
| + | </ | ||
| + | |||
| + | ====6.2 - Le Service chronyd==== | ||
| + | |||
| + | Sous RHEL 9, le serveur d' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# systemctl status chronyd | ||
| + | ○ chronyd.service - NTP client/ | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | | ||
| + | </ | ||
| + | |||
| + | Pour activer ce serveur, utilisez l' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# timedatectl set-ntp yes | ||
| + | |||
| + | [root@redhat9 ~]# timedatectl | ||
| + | Local time: Sat 2024-09-28 16:53:46 CEST | ||
| + | | ||
| + | RTC time: Sat 2024-09-28 14:53:46 | ||
| + | Time zone: Europe/ | ||
| + | System clock synchronized: | ||
| + | NTP service: active | ||
| + | RTC in local TZ: no | ||
| + | </ | ||
| + | |||
| + | Vérifiez ensuite que le service **chronyd** est démarré : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# systemctl status chronyd | ||
| + | ● chronyd.service - NTP client/ | ||
| + | | ||
| + | | ||
| + | Docs: man: | ||
| + | | ||
| + | Process: 2673 ExecStart=/ | ||
| + | Main PID: 2675 (chronyd) | ||
| + | Tasks: 1 (limit: 48800) | ||
| + | | ||
| + | CPU: 45ms | ||
| + | | ||
| + | | ||
| + | |||
| + | Sep 28 16:53:41 redhat9.ittraining.loc systemd[1]: Starting NTP client/ | ||
| + | Sep 28 16:53:41 redhat9.ittraining.loc chronyd[2675]: | ||
| + | Sep 28 16:53:41 redhat9.ittraining.loc chronyd[2675]: | ||
| + | Sep 28 16:53:41 redhat9.ittraining.loc chronyd[2675]: | ||
| + | Sep 28 16:53:41 redhat9.ittraining.loc chronyd[2675]: | ||
| + | Sep 28 16:53:41 redhat9.ittraining.loc systemd[1]: Started NTP client/ | ||
| + | Sep 28 16:53:46 redhat9.ittraining.loc chronyd[2675]: | ||
| + | Sep 28 16:53:46 redhat9.ittraining.loc chronyd[2675]: | ||
| + | </ | ||
| + | |||
| + | La commande **chronyc** permet de voir le statut de la synchronisation : | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# chronyc sources -v | ||
| + | |||
| + | .-- Source mode ' | ||
| + | / .- Source state ' | ||
| + | | / ' | ||
| + | || .- xxxx [ yyyy ] +/- zzzz | ||
| + | || Reachability register (octal) -. | ||
| + | || Log2(Polling interval) --. | | yyyy = measured offset, | ||
| + | || \ | ||
| + | || | ||
| + | MS Name/IP address | ||
| + | =============================================================================== | ||
| + | ^* 64.ip-54-39-23.net | ||
| + | ^- rikku.vrillusions.com | ||
| + | ^- rwhois.dargalsolutions.c> | ||
| + | ^- ntp.pawdesigns.ca | ||
| + | </ | ||
| + | |||
| + | ====6.3 - Le Fichier / | ||
| + | |||
| + | Le service **chronyd** maintient l' | ||
| + | calcule la dérive de l' | ||
| + | |||
| + | Les serveurs NTP configurés sont : **pool 2.rhel.pool.ntp.org iburst**. L' | ||
| + | |||
| + | Le protocole NTP utilise le port 123. Les serveurs de temps de racine s' | ||
| + | |||
| + | < | ||
| + | [root@redhat9 ~]# cat / | ||
| + | # Use public servers from the pool.ntp.org project. | ||
| + | # Please consider joining the pool (https:// | ||
| + | pool 2.rhel.pool.ntp.org iburst | ||
| + | |||
| + | # Use NTP servers from DHCP. | ||
| + | sourcedir / | ||
| + | |||
| + | # Record the rate at which the system clock gains/ | ||
| + | driftfile / | ||
| + | |||
| + | # Allow the system clock to be stepped in the first three updates | ||
| + | # if its offset is larger than 1 second. | ||
| + | makestep 1.0 3 | ||
| + | |||
| + | # Enable kernel synchronization of the real-time clock (RTC). | ||
| + | rtcsync | ||
| + | |||
| + | # Enable hardware timestamping on all interfaces that support it. | ||
| + | # | ||
| + | |||
| + | # Increase the minimum number of selectable sources required to adjust | ||
| + | # the system clock. | ||
| + | #minsources 2 | ||
| + | |||
| + | # Allow NTP client access from local network. | ||
| + | #allow 192.168.0.0/ | ||
| + | |||
| + | # Serve time even if not synchronized to a time source. | ||
| + | #local stratum 10 | ||
| + | |||
| + | # Require authentication (nts or key option) for all NTP sources. | ||
| + | # | ||
| + | |||
| + | # Specify file containing keys for NTP authentication. | ||
| + | keyfile / | ||
| + | |||
| + | # Save NTS keys and cookies. | ||
| + | ntsdumpdir / | ||
| + | |||
| + | # Insert/ | ||
| + | # | ||
| + | |||
| + | # Get TAI-UTC offset and leap seconds from the system tz database. | ||
| + | leapsectz right/UTC | ||
| + | |||
| + | # Specify directory for log files. | ||
| + | logdir / | ||
| + | |||
| + | # Select which information is logged. | ||
| + | #log measurements statistics tracking | ||
| + | </ | ||
| + | |||
| + | |||
| + | |||
| + | ----- | ||
| + | Copyright © 2024 Hugh Norris. | ||
