There are several types of linux log files

There are three types of Linux log files: 1. Kernel and system logs. This type of log data is managed uniformly by the system service rsyslog. Kernel messages and various system program messages are recorded according to the settings in its main configuration file. To what location. 2. User log. This type of log data is used to record information related to the login and exit of Linux operating system users, including user name, login terminal, login time, etc. 3. Program log, an independent log file of the specified program, used to record various event information during the running of the program.

#The operating environment of this tutorial: linux7.3 system, Dell G3 computer.

In the Linux system, there is a very flexible and powerful log function. It can save almost all operation records and retrieve the information we need. Not only that, Linux system logs can also help us solve various problems.

What are the types of Linux system logs?

There are three main types of Linux system logs: kernel and system Logs, user logs, program logs.

1. Kernel and system logs:

This kind of log data is managed uniformly by the system service rsyslog, based on its main configuration file /etc/rsyslog.conf The settings in determine where kernel messages and various system program messages are logged. A considerable number of programs in the system will leave log files to rsyslog for management, so the log records used by these programs also have a similar format.

2. User log:

This kind of log data is used to record information related to Linux operating system users logging in and exiting the system, including user name, logged-in terminal, Login time, source host, process operations in use, etc.

3. Program log:

Some applications will choose to independently manage a log file by themselves to record various event information during the running of the program. , instead of leaving it to rsyslog service management. Since these programs are only responsible for managing their own log files, the logging formats used by different programs may vary greatly.

Linux common log files and their functions

Log files are important system information files, which record many important system events, including User login information, system startup information, system security information, email-related information, various service-related information, etc. Some of this information is very sensitive, so in Linux these log files can only be read by the root user.

So, where are the system log files stored? Remember the /var/ directory? It is a directory used to save system dynamic data, so the /var/log/ directory is the location where system log files are saved. We use Table 1 to illustrate the important log files in the system.

Table 1 Important log files in the system

Log file	Description
/var /log/cron	Records logs related to system scheduled tasks
/var/log/cups/	Records logs of printing information
/var/log/dmesg	Records the kernel self-check information when the system is powered on. You can also use the dmesg command to directly view the kernel self-test information
/var/log/btmp	log that records incorrect logins. This file is a binary file and cannot be viewed directly with Vi. Instead, you must use the lastb command to view it. The command is as follows: [root@localhost log]#lastb root tty1 Tue Jun 4 22:38 - 22:38 (00:00) #Someone used root at 22:38 on June 4 User login error in local terminal 1
/var/log/lasllog	A log that records the last login time of all users in the system. This file is also a binary file and cannot be viewed directly with Vi. Instead, use the lastlog command to view the log of
/var/Iog/mailog
/var /log/messages	It is the core system log file, which contains boot information when the system starts and other status messages when the system is running. I/O errors, network errors, and other system errors are logged to this file. Other information, such as a person's identity switching to root, logs of user-customized software installations, will also be listed here.
/var/log/secure	Record verification and authorization information. All programs involving accounts and passwords will be recorded, such as system login and ssh. Login, su switching users, sudo authorization, even adding users and changing user passwords will be recorded in this log file
/var/log/wtmp	Permanently record all The user's login and logout information is also recorded, and the system's post-operation, restart, and shutdown events are also recorded. Similarly, this file is also a binary file. It cannot be viewed directly with Vi. Instead, use the last command to view
/var/tun/ulmp	to record the currently logged in users. Information. This file will continue to change as the user logs in and out, and only records the information of the currently logged in user. Similarly, this file cannot be viewed directly with Vi, but must be viewed using w, who, users and other commands.

In addition to the system default logs, it is installed using RPM packages. System services will also record logs in the /var/log/ directory by default (the service logs installed by the source code package are stored in the directory specified by the source code package). However, these logs are not recorded and managed by the rsyslogd service. Instead, each service uses its own log management document to record its own logs. The log directory introduced below may not exist on your Linux. The log will only appear if the corresponding service is installed. The service log is shown in Table 2.

Table 2 Service Log

Log File	Description
/var/log /httpd/	The default log directory for apache to be installed by the RPM package
/var/log/mail/	The email for the RPM package installation Additional logs for the service
/var/log/samba/	Log directory of the Samba service installed with RPM color
/var/log/sssd/	Daemon security service directory

How to check the system log status

We use the ps command to check the status of the log service rsyslog. Most of the log files in the system are managed uniformly by the rsyslogd service. As long as each process gives information to this service, it will automatically record the logs into different log files in a specific format. In other words, the format of log files managed by the rsyslogd service should be uniform.

Syntax

ps aux | grep "rsyslog" | grep -v "grep"

In the Linux system, there are some logs that are not managed by the rsyslogd service, such as the apache service, whose logs are generated and recorded by the Apache software itself Yes, the rsyslogd service is not called. However, in order to facilitate reading, the format of the apache log file is consistent with the format of the system default log.

Case

We use the ps command to view the system log service status. The specific command is as follows:

We As you can see, we used the ps command to view the service status of the system log rsyslog.

Related recommendations: "Linux Video Tutorial"

The above is the detailed content of There are several types of linux log files. For more information, please follow other related articles on the PHP Chinese website!