消息紧急程度排行
emerg:该系统不可用
alert：需要立即修改
crit：紧急情况
err：错误信息
warning：预警信息
notice：具有重要性的普通条件
info：提供信息的消息
debug：不包含函数条件或问题的其他信息
none：没有重要级，通常用于排错
有时候出错了，查看一下日志对排错是有很大帮助的，下面就来介绍一下各种日志文件
#/var/log/messages不仅是服务器的系统日志，还是许多服务的日志
[root@bogon ~]# tail -n10 /var/log/messages #查看最新的十条日志信息
Jun 26 05:21:46 localhost systemd: Starting Network Manager Script Dispatcher Service...
Jun 26 05:21:46 localhost dbus-daemon: dbus[518]: [system] Activating via systemd: service name='org.freedesktop.nm_dispatcher' unit='dbus-org.freedesktop.nm-dispatcher.service'
Jun 26 05:21:46 localhost dhclient[3825]: bound to 192.168.1.107 -- renewal in 2798 seconds.
Jun 26 05:21:46 localhost dbus[518]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
Jun 26 05:21:46 localhost dbus-daemon: dbus[518]: [system] Successfully activated service 'org.freedesktop.nm_dispatcher'
Jun 26 05:21:46 localhost systemd: Started Network Manager Script Dispatcher Service.
Jun 26 05:21:46 localhost nm-dispatcher: req:1 'dhcp4-change' [ens33]: new request (5 scripts)
Jun 26 05:21:46 localhost nm-dispatcher: req:1 'dhcp4-change' [ens33]: start running ordered scripts...
Jun 26 05:30:01 localhost systemd: Started Session 60 of user root.
Jun 26 05:30:01 localhost systemd: Starting Session 60 of user root.
[root@bogon ~]#
#有时候我们可能需要实时查看日志
tail -f /var/log/messages #该命令会一直刷新显示日志文件信息
执行效果就省略了
#查看系统安全日志ssh，telent，ftp等等
[root@bogon ~]# tail -n5 /var/log/secure
Jun 26 04:53:28 localhost polkitd[564]: Registered Authentication Agent for unix-process:9638:2696360 (system bus name :1.231 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Jun 26 04:53:29 localhost polkitd[564]: Unregistered Authentication Agent for unix-process:9638:2696360 (system bus name :1.231, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)
Jun 26 05:38:08 localhost gdm-password]: gkr-pam: unlocked login keyring
Jun 26 05:38:31 localhost polkitd[564]: Registered Authentication Agent for unix-process:12161:2966633 (system bus name :1.246 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Jun 26 05:38:33 localhost polkitd[564]: Unregistered Authentication Agent for unix-process:12161:2966633 (system bus name :1.246, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)
#上面的是什么啊，都看不懂，那我就直接查看ssh相关的信息吧，我一直使用ssh连接控制centos7
[root@bogon ~]# cat /var/log/secure |grep ssh
Jun 25 15:32:33 bogon sshd[1032]: Server listening on 0.0.0.0 port 22.
Jun 25 15:32:33 bogon sshd[1032]: Server listening on :: port 22.
Jun 25 18:31:12 bogon sshd[947]: Server listening on 0.0.0.0 port 22.
Jun 25 18:31:12 bogon sshd[947]: Server listening on :: port 22.
Jun 25 18:36:49 bogon sshd[11299]: Connection closed by 192.168.1.100 [preauth]
Jun 25 18:38:26 bogon sshd[11318]: Address 192.168.1.100 maps to bogon, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! #看到没，我从100这个ip登录的
#/var/log/wtmp是用来记录登录者的信息数据，是个二进制文件，使用cat查看是乱码，还记得用什么命令查看二进制文件吗（答案是xxd）
#既然如此，那我们就需要根据系统的设计，用last读取这个文件的内容了
[root@bogon ~]# last
root pts/1 192.168.1.100 Sun Jun 25 22:00 still logged in
root pts/0 :0 Sun Jun 25 21:25 still logged in
root :0 :0 Sun Jun 25 21:24 still logged in
(unknown :0 :0 Sun Jun 25 21:24 - 21:24 (00:00)
reboot system boot 3.10.0-514.el7.x Sun Jun 25 21:24 - 05:49 (08:25)
root pts/1 192.168.190.1 Sun Jun 25 20:36 - 21:19 (00:42)
root pts/1 :0 Sun Jun 25 20:09 - 20:09 (00:00)
root pts/1 192.168.1.100 Sun Jun 25 20:05 - 20:07 (00:01)
root pts/1 192.168.1.100 Sun Jun 25 19:21 - 20:04 (00:42)
root pts/1 192.168.1.100 Sun Jun 25 19:10 - 19:10 (00:00)
root pts/1 192.168.1.100 Sun Jun 25 19:09 - 19:09 (00:00)
bp pts/1 192.168.1.100 Sun Jun 25 19:08 - 19:09 (00:00)
root pts/1 192.168.1.100 Sun Jun 25 18:38 - 18:38 (00:00)
root pts/0 :0 Sun Jun 25 18:32 - 21:23 (02:50)
root :0 :0 Sun Jun 25 18:32 - 21:23 (02:51)
(unknown :0 :0 Sun Jun 25 18:31 - 18:32 (00:01)
reboot system boot 3.10.0-514.el7.x Sun Jun 25 18:30 - 05:49 (11:19)
root :0 :0 Sun Jun 25 08:54 - 08:58 (00:03)
(unknown :0 :0 Sun Jun 25 08:41 - 08:54 (00:13)
reboot system boot 3.10.0-514.el7.x Sun Jun 25 15:32 - 05:49 (14:17)
wtmp begins Sun Jun 25 15:32:02 2017
[root@bogon ~]#
#查看每个使用者最近登录系统的时间
[root@bogon ~]# lastlog|grep -E 'root|bp' #查看这两个帐号
root pts/1 192.168.1.100 Sun Jun 25 22:00:07 -0700 2017
bp pts/1 192.168.1.100 Sun Jun 25 19:08:40 -0700 2017
[root@bogon ~]# lastlog|grep -e 'bp|root'
[root@bogon ~]# lastlog|grep -E 'bp|root' #看到了吧，-e -E是有区别的，我开始时在这里就错用了-e
root pts/1 192.168.1.100 Sun Jun 25 22:00:07 -0700 2017
bp pts/1 192.168.1.100 Sun Jun 25 19:08:40 -0700 2017
[root@bogon ~]# lastlog|grep -E 'bp | root' #能看出来这里错在哪里吗 root前面多了个空格，所以配置时寻找的是root前面带空格的，而文件root是顶格写的，当然找不着
bp pts/1 192.168.1.100 Sun Jun 25 19:08:40 -0700 2017
[root@bogon ~]#
#服务器的邮件日志/var/log/messages,iptables（防火墙）日志也是在这里
#查看系统启动信息
[root@bogon rsyslog.d]# dmesg|head -10 #如果启动过程中提示有硬件损坏，那么可以用dmesg|grep erro查看
[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 3.10.0-514.el7.x86_64 (builder@kbuilder.dev.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC) ) #1 SMP Tue Nov 22 16:42:41 UTC 2016
[ 0.000000] Command line: BOOT_IMAGE=/vmlinuz-3.10.0-514.el7.x86_64 root=UUID=d46a9d1b-4fff-4097-ad89-09b482daa766 ro crashkernel=auto rhgb quiet LANG=en_US.UTF-8
[ 0.000000] Disabled fast string operations
[ 0.000000] e820: BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009ebff] usable
[ 0.000000] BIOS-e820: [mem 0x000000000009ec00-0x000000000009ffff] reserved
[ 0.000000] BIOS-e820: [mem 0x00000000000dc000-0x00000000000fffff] reserved
#cron日志
[root@bogon rsyslog.d]# head -10 /var/log/cron
Jun 25 15:32:34 bogon crond[1048]: (CRON) INFO (RANDOM_DELAY will be scaled with factor 17% if used.)
Jun 25 07:33:11 bogon crond[1048]: (CRON) INFO (running with inotify support)
Jun 25 07:40:02 bogon CROND[10035]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Jun 25 07:50:01 bogon CROND[10126]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Jun 25 08:00:01 bogon CROND[10215]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Jun 25 08:01:01 bogon CROND[10230]: (root) CMD (run-parts /etc/cron.hourly)
Jun 25 08:01:01 bogon run-parts(/etc/cron.hourly)[10230]: starting 0anacron
Jun 25 08:01:01 bogon anacron[10240]: Anacron started on 2017-06-25
Jun 25 08:01:01 bogon run-parts(/etc/cron.hourly)[10242]: finished 0anacron
Jun 25 08:01:01 bogon anacron[10240]: Will run job `cron.daily' in 28 min.
[root@bogon rsyslog.d]#