Services and logs Flashcards
Log file locations
/var/log/syslog /var/log/messages /var/log/auth.log /var/log/secure /var/log/
Location of configs related to log rotation
/etc/logrotate.d/file_name
Remote logging
Rsyslog is used for forwarding log messages in an IP network.
The main configuration file for rsyslog is /etc/rsyslog.conf. Here, you can specify global directives, modules, and rules that consist of filter and action parts.
__
vim /etc/rsyslog.d/my_file.conf
. @1.2.3.4:514 (send all logs from this pc to 1.2.3.4)
1.2.3.4 should be configured to accept requests on 514
@-udp
@@-tcp
Report the last login of each user on a system
Report of last log users into a system
lastlog, lastlog -u user_name
last
lastb
Conf file for journald
/etc/systemd/journald.conf
Query to systemd journal
journalctl [opt] [match]
journalctl -f -o verbose (o=output: short, verbose,json etc)
journalctl -p err (p=priority: err, crit,alert,emerg, notice,warning)
journalct -u ssh (u=unit)
Legacy: init startup
After the Linux kernel loads up
and it brings in the initial RAM disk, then seeks out an initialization system.
Kernel look for /sbin/init, then reads configuration at /etc/inittab at what runlevel system to be boot.
init performs some tasks from /etc/rc.d/rc.sysinit and boots up into runlevel
Legacy: 1. RH service tools
util that sets and queries rl settings or services
2. Util to manage services
3.Textual util for managing services based on their rl-s
- chkconfig –list -check all services that enabled or disabled on different rl-s
chkconfig httpd –level 3 on -sets httpd service to start on boot on rl3 - service httpd restart (start/stop/status)
- ntsysv
Legacy: Ubuntu’s upstart
/sbin/init=>startup=>in parallel: /etc/init/rc-sysinit.conf and mountall=>tellinit=>runlevel=>/etc/init/rc.conf=>login
Systemd Unit Files Location
1. Provided by package installation (do not edit): /usr/lib/systemd/system 2. For admins: /etc/systemd/system 3. Runtime unit files: /run/systemd/system
List all unit files on a system
systemctl list-unit-files
Components of Unit Files in general
[Unit]
Description=
Documentation=
Requires=units that will be activated when this unit is activated.
or Wants=similar to Requires but if something listed here fails, this will not prevent the unit from starting
Conflicts=units that should not be running when this unit is running
After=this unit starts after listed here units
Before=opposite of After
List contents of a unit file
systemctl cat unit_name.unit
systemctl
systemctl- show all units status on a system
systemctl status -complete status report in tree manner
systemctl status httpd
systemctl enable/disable httpd
systemctl start/stop httpd
systemctl restart httpd
systemctl is-active/is-enabled httpd
systemctl -H 1.2.3.4 status httpd.service
Modifying Unit Files
- Copy existing unit from /usr/lib64/systemd/system to /etc/systemd/system and edit this file
- Create drop-in Unit File
2.1. Create a dir /etc/systemd/system/httpd.service.d/ and file in this new dir my-httpd.conf
All changes here will be started first
2.2. systemctl edit
systemctl edit –full -this copy will replace the original unit file
Run systemd-delta to view modification
Run daemon-reload after any mod in unit files, this command will re-run dependencies
Target Unit Files
A target unit will sync up other units when computer boots or changes states.
It dictates the type of environment you would work in.
Often used to bring a system into a new state
multi-user.target similar to rl3
graphical.unit similar to rl5
rescue.target similar to rl1
basic.target set during boot before another target takes over
sysinit.target -system init
List units of specified unit-types
systemctl list-unit-files -t target
Get default target
Set default target
systemctl get-default
systemctl set-default multi-user.target
Change current target to another one
systemctl isolate unit-name.target
systemctl isolate multi-user.target
Switch to rescue target or default
systemctl rescue
systemctl default
Reboot/poweroff the system with systemctl
systemctl poweroff
systemctl reboot
Service Units
Along with typical section this will have:
[Service]
Type=simple/oneshot/forking/dbus/notify/idle
ExecStart=full path with args of command to be execute to start the process
TimeoutSec=This configures the amount of time that systemd will wait when stopping or stopping the service before marking it as failed or forcefully killing it.
[Install] -Contains info about service installation
WantedBy=lists units that will want this unit. Creates a symlink of this service to target unit’s *.wants directory
Link/unlink the service unit to /dev/null
systemctl mask httpd.service
systemctl unmask httpd.service
Timer Unit Files
[Timer]
Unit= (not necessary, if not present .service will be implied)
1. Monotonic
OnBootSec=, OnActiveSec=
2. Real-time
OnCalendar=--* 21:25:00
year-month-day
3. Transient Timers are setup by systemd-run command and do not require .service file
example: systemd-run –on-active=1m /bin/touch /root/hello
[Install]
WantedBy=timers.target
List all timers on the system
systemctl list-timers –all
