User Tools
регистрация_событий_в_linux
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
регистрация_событий_в_linux [2025/02/07 12:00] val [Регистрация сообщений, переданных по сети] |
регистрация_событий_в_linux [2026/08/08 17:47] (current) val [Журнал важных сообщений] |
||
|---|---|---|---|
| Line 9: | Line 9: | ||
| <code> | <code> | ||
| $ logger -t postfix -p mail.info 'Message from postfix' | $ logger -t postfix -p mail.info 'Message from postfix' | ||
| + | |||
| + | $ logger -t prog1 -p local1.warn 'Prog1 Warning' | ||
| + | $ logger -t prog1 -p local1.err 'Prog1 Error' | ||
| $ logger -t kernel -p kern.emerg 'Kernel Panic' | $ logger -t kernel -p kern.emerg 'Kernel Panic' | ||
| Line 21: | Line 24: | ||
| <code> | <code> | ||
| $ systemctl -a | grep syslog | $ systemctl -a | grep syslog | ||
| + | или | ||
| + | # apt install rsyslog | ||
| $ less /etc/rsyslog.conf | $ less /etc/rsyslog.conf | ||
| $ man rsyslog.conf | $ man rsyslog.conf | ||
| + | |||
| + | # rsyslogd -N1 | ||
| </code> | </code> | ||
| ==== Настройка на обработку сообщений типа local0 ==== | ==== Настройка на обработку сообщений типа local0 ==== | ||
| + | |||
| + | * [[Сервис ротации журналов]] | ||
| + | |||
| <code> | <code> | ||
| root@server:~# cat /etc/rsyslog.d/30-cisco.conf | root@server:~# cat /etc/rsyslog.d/30-cisco.conf | ||
| Line 37: | Line 47: | ||
| debian# chown root:adm /var/log/cisco.log | debian# chown root:adm /var/log/cisco.log | ||
| ubuntu# chown syslog:adm /var/log/cisco.log | ubuntu# chown syslog:adm /var/log/cisco.log | ||
| - | |||
| - | root@server:~# rsyslogd -N1 | ||
| root@server:~# service rsyslog restart | root@server:~# service rsyslog restart | ||
| Line 63: | Line 71: | ||
| # cat /etc/rsyslog.d/my.conf | # cat /etc/rsyslog.d/my.conf | ||
| </code><code> | </code><code> | ||
| - | ... | + | #... |
| module(load="imfile") | module(load="imfile") | ||
| + | |||
| + | input(type="imfile" File="/var/log/audit/audit.log" | ||
| + | Tag="audit" | ||
| + | Severity="info" | ||
| + | Facility="local6") | ||
| + | |||
| input(type="imfile" File="/var/log/openvpn/openvpn_status_bmstu.log" | input(type="imfile" File="/var/log/openvpn/openvpn_status_bmstu.log" | ||
| Tag="openvpn" | Tag="openvpn" | ||
| Severity="info" | Severity="info" | ||
| Facility="local0") | Facility="local0") | ||
| - | ... | + | |
| - | *.* @server.corpX.un:8514 | + | #:msg, contains, "adduser" stop |
| + | #:msg, contains, "edituser" stop | ||
| + | |||
| + | #*.* @server.corpX.un:8514 | ||
| + | #*.* @192.168.100+X.10 | ||
| + | </code> | ||
| + | |||
| + | ==== Журнал важных сообщений ==== | ||
| + | |||
| + | <code> | ||
| + | # cat /etc/rsyslog.d/40-syslog-high.conf | ||
| + | </code><code> | ||
| + | template(name="WithSeverityFacility" type="string" string="%TIMESTAMP% %HOSTNAME% [%syslogfacility-text%.%syslogseverity-text%] %syslogtag%%msg%\n") | ||
| + | |||
| + | #$ActionFileDefaultTemplate WithSeverityFacility | ||
| + | |||
| + | #*.* -/var/log/syslog.high;WithSeverityFacility | ||
| + | *.warning -/var/log/syslog.high;WithSeverityFacility | ||
| + | |||
| + | #if (not ($msg contains "PNP0A03") and | ||
| + | # not ($msg contains "LPM") and | ||
| + | # not ($msg contains "vmwgfx") and | ||
| + | # not ($msg contains "ehci_hcd")) then { | ||
| + | # *.warning;local3.none -/var/log/syslog.high;WithSeverityFacility | ||
| + | # local3.crit -/var/log/syslog.high;WithSeverityFacility | ||
| + | #} | ||
| + | </code> | ||
| + | * [[#Настройка на обработку сообщений типа local0]] | ||
| + | <code> | ||
| + | # cat /var/log/syslog.high | egrep -v '\[emerg\]|\[alert\]|\[crit\]|\[err\]|\[warning\]|\[notice\]|\[info\]|\[debug\]' | ||
| </code> | </code> | ||
| ==== Передача сообщений на STDIN программы ==== | ==== Передача сообщений на STDIN программы ==== | ||
регистрация_событий_в_linux.1738918816.txt.gz · Last modified: 2025/02/07 12:00 by val
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
