System monitoring Flashcards
log
records system events. startup, driver loaded, logon. time of event, user who caused it, etc.
the act of creating logs
logging
where is the Windows log?
The Event Viewer
some reasons to use event viewer:
curious, crashing game, logon, first step.
what to type in run box to get event viewer:
eventvwr.msc
what does the default view of Event Viewer show?
the summary of potentially important recent events
what can you see in the left hand pane of event viewer?
a few different groups of event types?
what is custom views in event viewr?
you can make a filter that will look across all event logs and get what you want, specifically, rather than digging through everything you don’t want.
how do you make a custom view of error severtity and critical or higher events logged in the last hour?
create custom view in right hand actions pane, filter, error and critical checkboxes, log: drop down menu: last hour, event logs: Windows logs. Ok. View:, View name:
what are Windows category logs?
event logs applying to the whole OS. driver issues during startup, for example.
where are security logs?
in windows log category logs.
what are applications and service logs?
logs that track events from a single application or os component instead of the system-wide events.
where could you check if you were having trouble with PowerShell and wanted information about it?
applications and services, PowerShell
what does each line in a given log in the Event Viewer represent?
an event
what does each event contain?
information grouped in columns about the event. logging level, information, critical, date and time, detailed info if event is selected, in the bottom of the event viewr.
why look at more detailed info?
to dig into troubleshooting or give context for a bug report
Where are logs in Linux stored
/var/log
what does /var stand for?
Variable
What are variable files
files that constantly change
why are logs kept in the /var folder?
they’re constantly changing
what is /var/log/auth.log?
authorization, Security related events
what is /var/log/kern.log?
Kernel messages
what is /var/log/dmesg
System start up messages
What log file on a Linux system logs pretty much every log on your system
/var/log/syslog
what does syslog not log by default?
off events
what should be your first stop when looking at Linux logs if you don’t have a very specific idea of what is the problem?
/var/log/syslog
How does Linux clean out old log files to make room for new ones
log rotation, Log rotate,
How can you make sure that you have access to logs from a month ago
change your log rotation settings in Linux So that your machine won’t delete your old logs
What is centralized logging used for
managing multiple machines and trying to see the logs from each of those machines
What is the first field in an event log
the time stamp when an event occurred
What is a long string of numbers sort of time stamp format called? ex 150-153-8594
Unix epoch time
What is unix epoch time used to represent
Number of seconds since midnight on January first nineteen seventy, For unix based computers to anchor their concept of time out of Coordinated universal time, utC
Log rotate supplemental reading link
https://manpages.ubuntu.com/manpages/oracular/en/man8/logrotate.8.html
but command rotates compresses and mails system logs
logrotate
What does the force parameter do for log rotate
forces log rotate to force the rotation even if it doesn’t think this is necessary
What is the first thing that you look for if you’re not sure what the issue is
the word error
what if you’re saying an issue with a specific application what can you search for?
the application name in the logs
how to get error from logs in Linux:
less /var/log/syslog | grep error
how do you check timestamps for errors that happened at a specific time?
less /var/log/syslog , and look for the right timestamp
What should you do would you get to a log portion that might help you uncover the problem that you’re looking for?
start looking at the output from either the top or bottom
What happens if you resolve a root issue
you resolve the problems it causes
When do you want to work from the bottom up?
if you weren’t seeing any issues you can figure it in the log so you can figure things out if you come across a clue
How can you look at logs in real time
tail command
tail -f /var/log/syslog
keep in an open window, and make an event happen, watch the events that get logged to track in real time.
what must be true to connect ssh to a client?
ssh is installed on client, ssh server is running on host you want to connect to, you need to specify a hostname to ssh into
