> For the complete documentation index, see [llms.txt](https://alicenab.gitbook.io/linux/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alicenab.gitbook.io/linux/redhat/redhat-administration-1-rh124/chapter-11.md). # Chapter 11 systemd-journald - logları binary formatda yadda saxlayır, loqlara baxmaq üçün journalctl komandası lazım olur. syslog - loqları text formatda yadda saxlayır rsyslog - syslogun inkişaf etdirilmiş formasıdır, log forwarding üçün də istifadə olunur. journald loqlarını da rsyslogla forward etmək mümkündür. ``` /var/log/messages /var/log/secure /var/log/maillog /var/log/cron /var/log/boot.log ``` ## rsyslog Dokumentasiya: ``` /usr/share/doc/rsyslog/html/ index.html ``` ### ryslog configuration paths: ``` /etc/rsyslog.conf /etc/rsyslog.d/*.conf ``` rsyslogda rulelar bu patternə uyğundur: ``` ``` facilitylərə nümunlər: ``` kern: Kernel messages. user: User-level messages. mail: Mail system. daemon: System daemons, which are background processes/services. auth: Security/authorization (also often used by authentication systems). syslog: Messages generated internally by the syslog daemon. lpr: Line printer subsystem. news: Network news subsystem. uucp: Unix-to-Unix copy system. cron: Cron daemon (scheduling and automation). authpriv: Security/authorization messages requiring privacy. ftp: FTP daemon. local0: Locally used facility. ... local7: Locally used facility. ``` severity-lər:
CODEPRIORITYSEVERITY
0emergSystem is unusable
1alertAction must be taken immediately
2critCritical condition
3errNon-critical error condition
4warningWarning condition
5noticeNormal but significant event
6infoInformational event
7debugDebugging-level message
``` # Bütün mailləri bir yerdə yadda saxlamaq üçün # - olması, ryslog-un maillog faylı ilə birbaşa sinxranizasiyaya keçməyəciyin bildirir # - olmasa, rsyslog xəbəri olan hər eventi fayla append edir. mail.* -/var/log/maillog # Bütün facilitylərdəki emerg loqlar hal-hazırda login olmuş istifadəçilərin terminalında görsənsin *.emerg :omusrmsg:* # Həmin loqlar sadəcə alicenab istifadəçisinin terminalında görsənsin. *.emerg :omusrmsg:alicenab ``` Digər actionlara nümunələr: ``` # enables writing messages to file and it is typically invoked without explicitly being named :omfile: # *.info /var/log/messages # Used for forwarding log messages to a remote server using different protocols :omfwd: # *.* @@remote-host:514 (Using TCP to forward messages to a remote host # Allows executing shell commands with log message content. :omshell: # :omshell:/path/to/shell/script # Used to send log messages via email. :ommail: # :ommail:mail.example.com,from@example.com,to@example.com # Directs log messages to a named pipe (FIFO). :ompipe: # *.* :ompipe:/path/to/pipe.fifo # Used for forwarding log messages to an external program’s standard input. :omprog: # *.* :omprog:/path/to/script # Sending messages to a remote server using the RELP (Reliable Event Logging Protocol). :omrelp: # *.* :omrelp:remote-host:2514 # Forwarding messages using UDP while spoofing the IP address. :omudpspoof: # *.* :omudpspoof:ip-to-spoof,remote-host # Producing messages to Apache Kafka brokers. :omkafka: # Producing messages to Apache Kafka brokers. # Producing messages to Apache Kafka brokers. :omclickhouse: # Producing messages to Apache Kafka brokers. ``` ### send manual syslog entry ``` logger -p local7.notice "Log entry created on host" logger -p user.debug "Debug Message Test" ``` ### Logrotate Loqlar sistemdə çox yer tutmasın deyə onları arxivləşdirir, 4 həftədən sonra silir. ## journalctl ``` journalctl -n 5 journalctl -f journalctl -p err # err ve yuxari prioritetler journalctl --since today journalctl --since "-1 hour" journalctl --since "2014-02-10 20:30:00" --until "2014-02-13 12:00:00" journalctl -o verbose journalctl _SYSTEMD_UNIT=sshd.service _PID=1182 journalctl --since 9:00:00 _SYSTEMD_UNIT="sshd.service" --since "-10min" ``` #### persistent journalctl Default olaraq bütün loqlar `/run/log/journal` qovluğunda saxlanıldığı üçün, rebootdan sonra journalctl dataları silinir. `/etc/systemd/journald.conf` faylında dəyişiklik edərək həmin loqların daimi saxlanmasına şərait yarada bilərik. * persistent - /var/log/journal qovluğunda persistent olaraq saxlayır * volatile - /run/log/journal qovlugunda reboota qədər saxlayır * auto - sistemdə /var/log/journal qovluğu olarsa persistent, olmazsa volatile saxlayır Persistent etmək üçün aşağıdakı konfiqurasiyanı etmək lazımdır ``` sudo vim /etc/systemd/journald.conf [Journal] cStorage=persistent ``` Bir boot qabaqkı loqlara baxmaq üçün: ``` journalctl -b 1 journalctl -b 2 # 2 boot qabaqki loqlar ``` ## Maintaining accurate time ### timedatectl ``` timedatectl timedatectl list-timezones | grep Baku timedatectl set-timezone Asia/Baku tzselect # interactive timedatectl timedatectl set-time 9:00:00 timedatectl set-ntp true ``` ### chronyd Configuration file: ``` sudo vim /etc/chrony.conf ``` Stratum - Server və NTP serverlə arada olan hop sayı ``` systemctl restart chronyd ```