[No audio]
Hello, and welcome to log monitoring lesson.
Another and most important way of
system administration is log monitors.
Think of a log monitor in a way as if you
have, if you have your personal physician or a doctor
every time you go to him, he or she has a chart
on you with the record of your medical history, which tells
the doctor what are the problems you had in the past,
whether you had any surgery, whether you're allergic to any medicine.
So that is the way doctors
keep logs on your physical health.
Just like that,
systems also have to keep logs and generate logs
and record everything that goes on with the system.
So in our log directory, right here in our Linux
system, the primary log directory is var and /log.
All the logs that are generated in Linux
machines are mainly in /var/log directory, unless
specified or changed in the configuration file of
an application to change the log location.
Few of the logs that we will
cover in this lesson are one, number one is boot.
boot is the log when your system boots up, reboots, it generates
this log, and records everything that goes on
to your system, how it cleans up the
memory, what are the processes starting up,
if it is having any issues,
it will log everything in there.
Then you have chronyd, which is a newer version of NTP,
it has its own log. cron, maillog, secure logs,
the next one we have the messages
log. messages is one of the important logs that
every system administer, uses to monitor system activities.
Everything that is hardware wise, application wise or process
wise, anything that has to do with assistance or
even application wise, it goes into /var/log messages.
Then at the last one we have httpd,
which is also an Apache application log.
So, without further ado, I will
log into my Linux machine.
I log in as myself.
I already have an IP that has specified.
So once I log in, I will go into /var/log directry.
When I am in /var/log directory, I could run ls -l
command, or simply run ll, and view all the logs.
And once again, when I run that it has
so many logs, so many files, so many directories
that I cannot view them all in one page.
So what I will do is ll, pipe it to more, and you
will see, ll will list all the files by alphabetical orders.
So the first one is audit.
audit is one of the files or
directory that has all the audit information.
Then we have boot.log.
Let's look at boot.log.
When you do more on boot log,
I get a message say Permission denied.
Why do I get that message?
Because the boot.log is owned by root, and
the group who owns that file is also root.
So, am I root?
whoami, I'm not root.
Okay, so if I'm not root, do I have
the permission to read the file? And as others
I should have read permission right here, right?
Last three bits.
Or if I'm part of the group, I should have access here.
So neither group nor regular ordinary users
have access to read a file.
So only root has it.
So we will become root.
[No audio]
Go back to /var/log and we'll do boot.log.
When I hit enter, you'll see on the left side, it
is coming up with OK messages while system is booting up.
Every time there is an issue with the
system booting up, it will come up with
a message saying false or error or alert.
So you'll see, it is starting
all the services one by one.
It is starting all the processes.
Welcome to CentOS Linux 7.
It's going through each step of this boot startup, and
when it starts up completely, it stops the log.
When you reboot your system, this file, which
is sorry, ls -l boot.log, this file gets overwritten.
So if I reboot my machine right now, it will generate
a newer file and it will rewrite the boot.log.
Okay, so next one we have
is chrony. chrony is replacement of NTP service.
Any type of changes that we make on the
chrony service, it actually generates a log and it
actually logs that information into that log.
Next one we have in the list is cron.
If you look at it on the left hand
side, I'm just going by what I have listed.
There are many other files and if you have
time and if you are interested in learning all
these different logs, then please be my guest. Try
out every command, oh sorry,
try out every file and see what they are used for.
The next one I wanted to cover
is the cron, which is right here.
Whenever you schedule a job or a process through a
cron tab entry, it generates some kind of activity and
that activity or that record is logged into this file.
So you could do cron and you will
see all the information about the cron.
And by the way, whenever you open up a log
file, the first is the month, second is the date,
time, the name of your hostname, the daemon which
is CROND, and Process ID associated with that daemon,
the user who's running that, and the command or the
entry that has been associated with the cron.
Moving on, we have the next one, we have
quickly, there is a command called the message.
When you run this command, this one
also gives you information about the hardware.
If you do not want to run this command,
you could simply do cat on the messages as
well, which will give you the exact same information.
The next one we have is maillog.
maillog has all the information about your sendmail daemon,
which means every time you send an
email out or every time an email comes in,
all that activity is being recorded in this log.
[No audio]
Whenever you are troubleshooting issues
with sendmail service,
this is one of the logs you will have to look into
to see why your server is not able to send emails.
Moving on, then we have secure log right here.
Now secure logs is the log that actually
records all your logging in, logging out activity.
So when you do more on secure, you'll see all
the users that have been logged in, if they have
failed logging in, or from which machine they are logging
in, all the information about the users.
So what I'm going to do is I'm going to do tail -f.
Now -f is the option that
will keep on sniffing the log.
And every time a new record is updated to the log, that
tail -f will get that newest log at the bottom.
So if I do tail -f secure, and
I'll keep running this command. This command is running
now I'm going to open up another session, another
PuTTY session I have already saved.
And if I log in as myself and I type
in wrong password, let's say, as soon as I type
wrong password, you see in the background, it says right
here, Failed password for iafzal, and I'm trying
to log in from this machine, 192.168.1.8
If I log back in with the correct password,
then I will get that additional record for my
session saying, session opened for user iafzal.
So this is about the secure, the secure log file and
the next one is one of the most important log
files that you should spend your time in is messages.
Every time there is an issue with your machine, the
first thing an administrator does, they log into your machine
and they will trace logs in messages file.
So you go into cd /var/log, and
then you do more on messages.
Now this file has again, once again this file
has all the hardware information, all the software information,
all the application information, all the processes information, everything
is being logged into this log.
So if I wanted to see how many lines this log file
has, I could do cat messages and do wc -l.
So you see I have 7103 lines. If I wanted to see
if there are any error messages in this file.
So I'll do grep -i, i is to
ignore uppercase lowercase from messages file. and you'll see
it actually greppd every line inside of this log
file that has a message called error.
So this way you could go in and
see what's going on with your system, what
happened, why it failed, what time it failed.
So anyway, let's wrap up the lesson and
again spend some time in this /var/log messages.
Go over all these log files, specifically the
ones I have in this lesson and see
what type of different logs there are.
view them, grep them for certain errors
and get yourself familiar with them.
[No audio]