Hello and welcome to log monitoring lesson another and most important way of system administration is
log monitors.
Think of a log monitor in a way, as if you have if you have your personal physician or a doctor every
time you go to him, he or she has a chart on you, which the record of your medical history, which
tells the doctor, what are the problems you had in the past, whether you had any surgery, whether
you're allergic to any medicine.
So that is the way doctors keep logs on your physical health, just like that.
Systems also have to keep logs and generate logs and record everything that goes on with the system.
So in our log directory right here in our limbic system, the primary log directory is war and slash
log.
All the logs that are generated in Linux machines are mainly in your log directory unless specified
or changed in the configuration file of an application to change the log location.
A few of the logs that we will cover in this lesson are one.
No.
One is Bhoot, but is the log.
When you system boots up reboots, it generates this long and records everything that goes on to your
system, how it cleans up the memory, what are the processes starting up?
If it hasn't, if if it is having any issues, it will log everything in there, then you have a chronic
disease, which is a newer version of A.P. It has its own log chron mail log secure logs.
The next one we had the messages log messages is one of the important logs that every system in Missouri
uses to monitor system activities.
Everything that is hardware wise, application wise or process wise, anything that has to do with the
systems or even application wise, it goes into log messages.
Then at the last one we have HTP, which is also an Apache application log.
So without further ado, I log into my Linux machine.
I log in as myself.
I already have an IP that has specified.
So once I log in, I will go into Wahhab Slash log directory.
When I am Inglot directory, I go on Ellis' minus L command or simply run parallel and view all the
logs.
And once again when I run that it has so many logs, so many files, so many directories that I can
review them all in one page.
So I will do this.
L l pipe it to more and you will see l l will list all the files by alphabetical orders.
So the first one is audit audit as one of the files or directory that has all the audit information.
Then we have Baudot log.
Let's look at don't log and you do more on the log.
I get in message say permission denied.
Why do I get that message.
Because the log is owned by route and the group who owns that file is also route.
So am I route.
Who am I?
I'm not route.
OK, so if I'm not route, do I have the permission to read the file?
And as others, I should have read permission right here.
Right last three minutes.
Or if I'm part of the group I should be, I should have access here so neither group nor regular ordinary
users has access read a file so only route hasn't.
So we will become route.
Go back to our log and we'll do poop.
Don't log when I hit enter you'll see on the left side it is coming up with OK messages while the system
is boarding up.
Every time there is an issue with the system booting up, it will come up with a message saying false
or error alert.
So you'll see it is starting all the services one by one.
It is starting all the processes.
Welcome to as Linux seven.
It's going through each step of the CPU startup and when it starts up completely, it stops the log
when you reboot your system, this file.
Which is so unless myself, elbow to log, this file gets overwritten, so if I reboot my machine right
now, it will generate a newer file and it will rewrite this bootleg.
OK, so next one we have is cronie cronie as a replacement of A.P. service.
Any type of changes that we make on the cronie service, it actually generates that long and it actually
locks that information into their lives.
Next one we have in the list as Chron.
If you look at it on the left hand side, I'm just going by what I have listed.
There are many other files and if you have time and if you are interested in learning all these different
logs, then please be my guest, try out every comment I'm sorry trial and report and see what they
are used for.
The next one I want to cover is the Quran, which is right here.
You whenever you schedule a job or a process through a Quran tab and tree, it generates some kind of
activity.
And that activity or that record is logged into this file.
So you could do a Quran and you will see all the information about the Quran.
And by the way, whenever you open up a log file, the first is the month.
2ND is the date time.
The name of your host name, The Demon, which is Quraan death.
And the process ID associated with that demon, the user who is running that and the command or the
entry that has been associated with ACRON.
Moving on, we have the next one we have quickly.
There is a command called Message You and you run this command.
This one also gives you information about the hardware.
If you do not want to run this command, you could simply do cat on D messages as well, which will
give you the exact same information.
The next one we have as mail log mail log has all the information about your sendmail daemon, which
means every time you send an email out or every time an email comes and all that activity is being recorded
in this log, whenever you are troubleshooting issues with send mail service, this is one of the logs
you would have to look into to see why you are where your server is not able to send emails.
Moving on.
Then we have a secure log right here.
Now, secure logs is the log that actually records all your logging in logging our activity.
So when you do more on secure, you'll see all the users that have been logged in if they have failed
logging in or if they from which machine they're logging in, all the information about the users.
So I am what I'm going to do is I'm going to do tail minus that.
Now, minus F is the option that will keep on sniffing the log.
And every time a new record is updated to the log, that tail minus F will get that newest log at the
bottom.
So if I do tail minus F secure and I'll keep running this command, this command is running now.
I'm going to open up another session, another position I have already saved.
And if I log in as myself and I type in wrong password, let's say as soon as I type a wrong password,
you see in the background, it says right here, fail the password for I saw and I'm trying to log in
from this machine one eight one sixty one eight.
If I log back in with the correct password, then I will get that additional record for my session sync
session open for user I have solved.
So this is about to secure the secure log file and the next one is one of the most important log files
that you should spend your time in is messages.
Every time there's an issue with you machine, the first thing an administrator does, they log into
your machine and they will trace the logs in messages file.
So you go into Siwa Log and then you do more messages.
Now, this file has again.
Once again.
This file has all the hardware information, all the software information, all the application information.
The processes, information, everything is being logged into this log, so if I wanted to see how many
lines this log file has, I could Dukat messages and do W.S. myself.
Let's see, I have seven thousand one hundred three lines.
If I wanted to see if there are any error messages in this file.
So I do.
Minus I is to ignore uppercase lowercase from messages file and you will see it actually grabbed every
line inside of this log file that has a message called error.
So this way you could go and see what's going on.
Would you system what happened, why it failed, what time it failed.
So anyway, let's wrap up the lesson and again, spend some time in this wall of messages go over all
these laws, specifically the ones I have in this lesson and see what type of different logs there are
of them for certain errors and get yourself familiar with them.