Linux Logging

Question 1

/user/log/dmesg

Answer 1

Kernel boot messages

Question 2

/var/log/messages

Answer 2

Standard syslog messages

Question 3

/var/log/secure

Answer 3

Security log messages. Info on login attempts.

Question 4

/var/log/maillog

Answer 4

Local email log messages/

Question 5

dmesg

Answer 5

Utility allowing an administrator to
view /var/log/dmesg file in text pager.
—level=,..:show levels specified. Abbreviated.
Ex: warn,err
-x:decode facility and level info to human readable.

Question 6

Dmesg levels

Answer 6

0 emerg sys. unusable
1 alert immediate action
2 critical critical condition
3 err error condition
4 warn warning condition
5 notice normal but significant
6 info informational
7 debug debug-level

Question 7

Kernel messages

Answer 7

user: random user-level
mail: mail system
daemon: system daemon
auth: security/authorization
syslog: messages generated by syslog
lpr: line printer subsystem
news: network news subsystem

Question 8

syslog

Answer 8

Timestamp, hostname generating, item generating event message.
-f: real time output

Question 9

logger

Answer 9

Command to send info to /var/log/messages

-t: tag in””

Question 10

journalctl

Answer 10

Defaults to journal w. oldest date at top.
-b: boot up, since
—disk-usage: amount of disk space journal consuming
-e: end
-F: reverse and folllow
-k: kernel only
—list-boots: shows list of recorded boot sessions
-n: newest number
-o: output format
verbose: all entry items with fields
json-pretty
systemd-cat
—rotate: rotate journal files
—since: with —until displays logs within specific window with time format “yyyy-mm-dd hh:mm:ss”
—until:
-u: logs of unit.
-x: log lines with text from message catalog. Not all will be available.

Question 11

systemd journal

Answer 11

Binary file on everything
Kernel log msg.
System log msg. With the same formatting as syslog.
Syslog services output to stdout/stderr.
Defaults to /run/log/journal. Volatile
1.1.1.1

Question 12

journald configuration

Answer 12

/etc/systemd/journald.conf
[Journal]
Storage=
auto-default: will store to /var/log/journal and /run/log/journal
persistent: stored to /var/log/journal hierarchy
volatile: only sent to /run/log/journal
none: no data kept
SystemMaxUse=,RuntimeMaxUse=
SystemMaxFileSize=,RuntimeMaxFileSize=
MaxRetentionSec=

Question 13

/etc/rsyslog.conf

Answer 13

Main configuration file for rsyslog logging daemon. SELECTOR LINES in format of .
Ex: *.info
File name off to the side indicates location.
With dash means that the recording can wait.

Question 14

/etc/logrotate.conf

Answer 14

Main configuration file for rotate daemon responsible for managing storage and rotation of old files.
Can show rotate rate, keep size, date suffix, compression,

Question 15

/etc/logrotate.d/

Answer 15

Extra logrotate config for other daemons to be placed.

Question 16

logrotate

Answer 16

Will rotate log based on specified configuration file.