This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
регистрация_событий_в_linux [2016/09/13 13:41] val [Регистрация сообщений, переданных по сети] |
регистрация_событий_в_linux [2018/03/02 16:19] val [Настройка на обработку сообщений типа local0] |
||
---|---|---|---|
Line 7: | Line 7: | ||
<code> | <code> | ||
$ logger -t postfix -p mail.info 'Message from postfix' | $ logger -t postfix -p mail.info 'Message from postfix' | ||
- | </code> | ||
- | ===== Systemd journald ===== | ||
- | * [[https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs|How To Use Journalctl to View and Manipulate Systemd Logs]] | ||
- | |||
- | ==== Форматы вывода ==== | ||
- | <code> | ||
- | # journalctl -ra | ||
- | |||
- | # journalctl --no-pager | ||
- | # journalctl -o json | + | $ logger -t kernel -p kern.emerg 'Kernel Panic' |
- | + | ||
- | # journalctl -o verbose | + | |
- | + | ||
- | # journalctl -f | + | |
</code> | </code> | ||
- | ==== Фильтрация вывода ==== | ||
- | <code> | ||
- | # journalctl -ra -u postfix | ||
- | |||
- | # journalctl -ra -p err | ||
- | |||
- | # man systemd.journal-fields | ||
- | |||
- | # journalctl SYSLOG_FACILITY=2 | ||
- | </code> | ||
- | |||
- | ==== Управление ==== | ||
- | <code> | ||
- | # man journald.conf | ||
- | |||
- | # journalctl --disk-usage | ||
- | |||
- | # journalctl --vacuum-size=1G | ||
- | </code> | ||
- | |||
- | ==== Регистрация сообщений, переданных по сети ==== | ||
- | |||
- | * [[http://unix.stackexchange.com/questions/83173/receiving-syslog-messages-with-a-systemd-arch-linux|Receiving Syslog messages with a systemd]] | ||
===== Сервис rsyslog ===== | ===== Сервис rsyslog ===== | ||
Line 61: | Line 25: | ||
root@server:~# touch /var/log/cisco.log | root@server:~# touch /var/log/cisco.log | ||
- | root@server:~# chown syslog:adm /var/log/cisco.log | + | root@server:~# chown root:adm /var/log/cisco.log |
- | root@server:~# restart rsyslog | + | root@server:~# service rsyslog restart |
root@server:~# tail -f /var/log/cisco.log | root@server:~# tail -f /var/log/cisco.log | ||
Line 69: | Line 33: | ||
==== Регистрация сообщений, переданных по сети ==== | ==== Регистрация сообщений, переданных по сети ==== | ||
+ | |||
+ | === Сервер === | ||
<code> | <code> | ||
root@server:~# cat /etc/rsyslog.conf | root@server:~# cat /etc/rsyslog.conf | ||
Line 80: | Line 46: | ||
</code> | </code> | ||
- | ===== Дополнительные материалы ===== | + | === Клиент rsyslog === |
+ | <code> | ||
+ | # cat /etc/rsyslog.conf | ||
+ | </code><code> | ||
+ | ... | ||
+ | *.* @server.corp13.un | ||
+ | </code> | ||
+ | ==== Передача сообщений на STDIN программы ==== | ||
+ | <code> | ||
+ | root@server:~# cat /etc/rsyslog.conf | ||
+ | </code><code> | ||
+ | ... | ||
+ | module(load="omprog") | ||
- | ==== Генератор отчетов ==== | + | local0.* action(type="omprog" binary="/etc/script.sh") |
+ | ... | ||
+ | </code><code> | ||
+ | root@server:~# service rsyslog restart | ||
+ | </code> | ||
- | [[Сервис MTA#Использование почтовых псевдонимов]] | + | ===== Генератор отчетов logwatch ===== |
+ | |||
+ | * [[http://ashep.org/2012/monitoring-sistemy-pri-pomoshhi-logwatch/|Мониторинг системы при помощи logwatch]] | ||
+ | * [[Сервис MTA#Использование почтовых псевдонимов]] | ||
<code> | <code> | ||
- | root@server:~# apt-get install logwatch | + | root@server:~# apt install logwatch |
root@server:~# /etc/cron.daily/00logwatch | root@server:~# /etc/cron.daily/00logwatch | ||
</code> | </code> | ||
- | ==== syslog facility ==== | + | ===== Systemd journald ===== |
+ | * [[https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs|How To Use Journalctl to View and Manipulate Systemd Logs]] | ||
+ | |||
+ | ==== Форматы вывода ==== | ||
+ | <code> | ||
+ | # journalctl -ra | ||
+ | |||
+ | # journalctl --no-pager | ||
+ | |||
+ | # journalctl -o json | ||
+ | |||
+ | # journalctl -o verbose | ||
+ | |||
+ | # journalctl -f | ||
+ | </code> | ||
+ | |||
+ | ==== Фильтрация вывода ==== | ||
+ | <code> | ||
+ | # journalctl -ra -u postfix | ||
+ | |||
+ | # journalctl -ra -p err | ||
+ | |||
+ | # man systemd.journal-fields | ||
+ | |||
+ | # journalctl SYSLOG_FACILITY=2 | ||
+ | </code> | ||
+ | |||
+ | ==== Управление ==== | ||
+ | <code> | ||
+ | # man journald.conf | ||
+ | |||
+ | # journalctl --disk-usage | ||
+ | |||
+ | # journalctl --vacuum-size=1G | ||
+ | </code> | ||
+ | |||
+ | ==== Регистрация сообщений, переданных по сети в journald ==== | ||
+ | |||
+ | * [[http://unix.stackexchange.com/questions/83173/receiving-syslog-messages-with-a-systemd-arch-linux|Receiving Syslog messages with a systemd]] | ||
+ | |||
+ | ==== journalctl SYSLOG_FACILITY ==== | ||
<code> | <code> | ||
0 kernel messages | 0 kernel messages |