Différences
Ci-dessous, les différences entre deux révisions de la page.
Prochaine révision | Révision précédente | ||
elearning:workbooks:redhat:rh124en:l110 [2024/11/13 09:57] – created admin | elearning:workbooks:redhat:rh124en:l110 [2024/11/28 08:57] (Version actuelle) – admin | ||
---|---|---|---|
Ligne 1: | Ligne 1: | ||
- | ~~PDF:PAYSAGE~~ | + | ~~PDF:LANDSCAPE~~ |
Version : **2024.01** | Version : **2024.01** | ||
Ligne 7: | Ligne 7: | ||
======RH12411 - Log Management====== | ======RH12411 - Log Management====== | ||
- | =====Module content===== | + | =====Contents===== |
- | * **RH12411 - Managing Logs** | + | * **RH12411 - Log Management** |
+ | * Contents | ||
* Overview | * Overview | ||
* The dmesg Command | * The dmesg Command | ||
Ligne 25: | Ligne 26: | ||
* The aureport Command | * The aureport Command | ||
* The ausearch Command | * The ausearch Command | ||
- | | + | |
* Applications | * Applications | ||
* LAB #2 - rsyslog | * LAB #2 - rsyslog | ||
Ligne 396: | Ligne 397: | ||
This file contains messages from the audit system, called **events**. The audit system is installed by default in RHEL 9 by the **audit** package. The audit system collects information such as: | This file contains messages from the audit system, called **events**. The audit system is installed by default in RHEL 9 by the **audit** package. The audit system collects information such as: | ||
- | * system calls | + | |
- | * file accesses, | + | * file accesses, |
- | * information from %%SELinux%%. | + | * information from %%SELinux%%. |
Take a look at the **/ | Take a look at the **/ | ||
Ligne 420: | Ligne 421: | ||
type=BPF msg=audit(1727528105.369: | type=BPF msg=audit(1727528105.369: | ||
</ | </ | ||
- | |||
- | Audit event management is based on three executables: | ||
===auditd=== | ===auditd=== | ||
Ligne 799: | Ligne 798: | ||
Some applications log in specific directories. For example : | Some applications log in specific directories. For example : | ||
- | * cups, | + | |
- | * httpd | + | * httpd, |
- | * samba | + | * samba, |
- | * ... | + | * ... |
< | < | ||
Ligne 887: | Ligne 886: | ||
| 0 | emerg/panic | System unusable | | | 0 | emerg/panic | System unusable | | ||
| 1 | alert | Immediate action required | | | 1 | alert | Immediate action required | | ||
- | | 2 | crit | Critical condition reached | + | | 2 | crit | Critical condition reached |
| 3 | err/error | Errors encountered | | | 3 | err/error | Errors encountered | | ||
| 4 | warning/ | | 4 | warning/ | ||
Ligne 1055: | Ligne 1054: | ||
</ | </ | ||
- | < | + | < |
**Important** : The two directives **module(load=‘imudp’)** and **input(type=‘imudp’ port=‘514’)** create a **Listener** on port UDP/514, while the two directives **module(load=‘imtcp’)** and **input(type=‘imtcp’ port=‘514’)** create a Listener on port TCP/514. Port 514 is the standard port for rsyslog Listeners. However, it is possible to change the port number. | **Important** : The two directives **module(load=‘imudp’)** and **input(type=‘imudp’ port=‘514’)** create a **Listener** on port UDP/514, while the two directives **module(load=‘imtcp’)** and **input(type=‘imtcp’ port=‘514’)** create a Listener on port TCP/514. Port 514 is the standard port for rsyslog Listeners. However, it is possible to change the port number. | ||
</ | </ | ||
Ligne 1118: | Ligne 1117: | ||
The value of the Facility and/or Priority can also be *****. In this case, all possible values of **Facility** and/or **Priority** are involved, for example: **cron.***. | The value of the Facility and/or Priority can also be *****. In this case, all possible values of **Facility** and/or **Priority** are involved, for example: **cron.***. | ||
- | ==n Facilities with Identical Priorities==. | + | ==n Facilities with Identical Priorities== |
Several Facilities can be stipulated for the same Priority by separating them with a **comma**. For example: **uucp, | Several Facilities can be stipulated for the same Priority by separating them with a **comma**. For example: **uucp, | ||
Ligne 1435: | Ligne 1434: | ||
< | < | ||
- | [root@redhat9 ~]# ls -l / | ||
- | total 0 | ||
- | drwxr-sr-x+ 2 root systemd-journal 53 Sep 28 15:39 5a35a3eb625c45cea1d33535723e791f | ||
[root@redhat9 ~]# journalctl | [root@redhat9 ~]# journalctl | ||
Sep 28 15:36:59 redhat9.ittraining.loc kernel: Linux version 5.14.0-427.37.1.el9_4.x86_64 (mockbuild@x86-64-02.build.eng.rdu2.redhat.com) (gcc (GCC) 11.4.1 20231218 (Red Hat 11.4.1-3), GNU ld version 2.35.2-43> | Sep 28 15:36:59 redhat9.ittraining.loc kernel: Linux version 5.14.0-427.37.1.el9_4.x86_64 (mockbuild@x86-64-02.build.eng.rdu2.redhat.com) (gcc (GCC) 11.4.1 20231218 (Red Hat 11.4.1-3), GNU ld version 2.35.2-43> | ||
Ligne 1591: | Ligne 1587: | ||
< | < | ||
- | [root@redhat9 ~]# journalctl -b | more | + | [root@redhat9 ~]# journalctl -p warning |
- | Sep 28 15:36:59 redhat9.ittraining.loc kernel: | + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: |
- | el9) #1 SMP PREEMPT_DYNAMIC Fri Sep 13 12:41:50 EDT 2024 | + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: |
- | Sep 28 15:36:59 redhat9.ittraining.loc kernel: | + | Sep 28 15:36:59 redhat9.ittraining.loc kernel: |
- | Sep 28 15:36:59 redhat9.ittraining.loc kernel: | + | Sep 28 15:37:00 redhat9.ittraining.loc systemd[1]: sys-module-fuse.device: Failed to enqueue SYSTEMD_WANTS= job, ignoring: Unit sys-fs-fuse-connections.mount not found. |
- | apper/rhel-swap rd.lvm.lv=rhel/ | + | Sep 28 15:37:00 redhat9.ittraining.loc kernel: |
- | Sep 28 15:36:59 redhat9.ittraining.loc kernel: | + | Sep 28 15:37:10 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:12 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:16 redhat9.ittraining.loc kernel: |
- | Sep 28 15:36:59 redhat9.ittraining.loc kernel: | + | Sep 28 15:37:20 redhat9.ittraining.loc kernel: |
- | Sep 28 15:36:59 redhat9.ittraining.loc kernel: | + | Sep 28 15:37:23 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:23 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:23 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:23 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:23 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:23 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:23 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:23 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:23 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:23 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:25 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:25 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:27 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:27 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:27 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:27 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:28 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:28 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:28 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:28 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:28 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:28 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:28 redhat9.ittraining.loc /usr/ |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:28 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:28 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:28 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:28 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:28 redhat9.ittraining.loc gsd-sharing[1908]: Failed to StopUnit service: GDBus.Error: |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:28 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:28 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:29 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:29 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:29 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:30 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:30 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:30 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:30 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:30 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:30 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:30 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:30 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:30 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:30 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:30 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:37:30 redhat9.ittraining.loc |
- | Sep 28 15:36:59 redhat9.ittraining.loc | + | Sep 28 15:39:43 redhat9.ittraining.loc |
- | --More-- | + | lines 1-55 |
- | [q] | + | |
</ | </ | ||
Ligne 1798: | Ligne 1793: | ||
In the case of a network server, it is often important to keep the machine' | In the case of a network server, it is often important to keep the machine' | ||
- | The protocol used is called **NTP **( **Network Time Protocol **) which uses port **123**. This allows synchronisation with several public servers. The root time servers are called **Strate | + | The protocol used is called **NTP **( **Network Time Protocol **) which uses port **123**. This allows synchronisation with several public servers. The root time servers are called **Stratum |
<WRAP center round important> | <WRAP center round important> | ||
Ligne 1979: | Ligne 1974: | ||
</ | </ | ||
- | ====6.3 - The / | + | ====6.3 - The / |
The **chronyd** service keeps the local hardware clock (RTC), which is usually inaccurate, at the correct time by synchronising it with the configured NTP servers. If no network connectivity is available, chronyd | The **chronyd** service keeps the local hardware clock (RTC), which is usually inaccurate, at the correct time by synchronising it with the configured NTP servers. If no network connectivity is available, chronyd |