Hello and welcome to log monitoring lesson another and most important way of system administration is
log monitors.
Think of a log monitor in a way, as if you have if you have your personal physician or a doctor every
time you go to him, he or she has a chart on you, which the record of your medical history, which
tells the doctor, what are the problems you had in the past, whether you had any surgery, whether
you're allergic to any medicine.
So that is the way doctors keep logs on your physical health, just like that.
Systems also have to keep logs and generate logs and record everything that goes on with the system.
So in our log directory right here in our limbic system, the primary log directory is bar and slash
log.
All the logs that are generated in Linux machines are mainly in our log directory unless specified or
changed in the configuration file of an application to change the log location.
A few of the logs that we will cover in this lesson or one No one is Bhoot, but is the log.
When your system puts up attributes, it generates this log and records everything that goes on to your
system, how it cleans up the memory, what are the processes starting up?
If it hasn't, if if it is having any issues, it will log everything in there, then you have a chronic
disease, which is a newer version of A.P. It has its own log chron mail log secure logs.
The next one we had the messages log messages is one of the important logs that every system industry
uses to monitor system activities, everything that is hardware wise, application wise or process wise,
anything that has to do with the systems or even application wise, it goes into Warralong messages.
Then at the last one we have a PDA, which is also an Apache application log.
So without further ado, I log into my Linux machine.
So once I log in, I'll go into Wahhab slash log directory when I am Inglot directory, I go on Ellis'
minus L command or simply run parallel and view all the logs.
And once again, when I run that it has so many logs, so many files, so many directories that I cannot
view them all in one page.
So I will do this.
Well, pipe it tomorrow and you will see l l will list all the files by alphabetical orders.
So the first one is audit audit.
As one of the files or directory that has all the audit information.
Then you have boot dot log.
Let's look at dot log and you do more on that log.
I get in message, permission denied.
Why do I get that message?
Because the boot that log is owned by route and the group who owns that file is also road.
So am I route.
Who am I.
I'm not route.
OK, so if I'm not route do I have the permission to read the file?
And as others, I should have read permission right here.
Right last three minutes.
Or if I'm part of the group, I should be, I should have access here so neither group nor regular ordinary
users has access read a file so only route hasn't.
So we will become route.
Go back to our log and we'll do not log.
When I hit enter you'll see on the left side it is coming up with OK messages while the system is boarding
up.
Every time there is an issue with the system booting up, it will come up with a message saying false
or error alert.
So you'll see it is starting all the services one by one.
It is starting all the processes.
It's going through each step of this startup, and when it starts up completely, it stops the log.
When you reboot your system, this file, which is so this is eligible to log this file, gets overwritten.
So if I reboot my machine right now, it will generate a newer file and it will rewrite this log.
OK, so next one we have is cronie cronie as a replacement of A.P. service.
Any type of changes that we make on the cronie service, it actually generates that long and it actually
locks that information into their lives.
Next one we have in the list is Chron.
If you look at it on the left hand side, I'm just going by what I have listed.
There are many other files and if you have time and if you are interested in learning all these different
logs, then please be my guest, try out every comment I'm sorry trial and report and see what they
are used for.
The next one I want to cover is Dacron, which is right here.
You whenever you schedule a job or a process through ACRON tab entry, it generates some kind of activity
and that activity or that record is logged into this file.
So you could do Chron and you will see all the information about Dacron.
And by the way, whenever you open up a log file, the first is the month 2nd as the date time, the
name of your host name, The Demon, which is Quraan D and Process ID associated with that deman the
user who is running that and the command or the entry that has been associated with that from moving
on.
We have the next one we have quickly.
There is a command called Message You and you run this command.
This one also gives you information about the hardware.
If you do not want to run this command, you could simply do cat on D messages as well, which will
give you the exact same information.
The next one we have as mail log mail log has all the information about your sendmail daemon, which
means every time you send an email out or every time an email comes and all that activity is being recorded
in this log, whenever you are troubleshooting issues with send mail service, this is one of the logs
you would have to look into to see why you are where your server is not able to send emails.
Moving on.
Then we have a secure log right here.
Now, secure logs is the log that actually records all your logging in logging our activity.
So when you do more on secure, you'll see all the users that have been logged in if they have failed
logging in or if the for which machine they're logging in, all the information about the users.
So I am what I'm going to do is I'm going to detail minus def now, minus F is the option that will
keep on sniffing the log.
And every time a new record is updated to the log, that tail minus F will get that newest log at the
bottom.
So if I do tail minus F secure and I'll keep running this command, this command is running now.
I'm going to open up another session, another position I have already saved.
And if I log in as myself and I type in wrong password, let's say as soon as I type wrong password,
you see in the background, it says right here, fail the password for Eisel and I'm trying to log in
from this machine one eight one sixty one eight.
If I log back in with the correct password then I will get that additional record for my session sync
session open for user I have solved.
So this is about to secure the secure log file and the next one is one of the most important log files
that you should spend your time in is messages.
Every time there's an issue with you machine, the first thing an administrator does, they log into
your machine and they will trace the log.
In messages while so you go into Kiwa log and then you do more messages.
Now, this file has again once again.
This file has all the hardware information, all the software information, all the application information,
all the processes, information, everything is being logged into this log.
So if I wanted to see how many lines this log file has, I could Dukat messages and W.S. myself.
So I have seven thousand one hundred three lines.
If I wanted to see if there are any error messages in this file.
So I'll do minus I is to ignore uppercase lowercase from messages file and you will see it actually
grabbed every line inside of this log file that has a message called error.
So this way you could go and see what's going on.
Would you system what happened, why it failed, what time it failed.
So anyway, let's wrap up the lesson and again, spend some time in this wall of messages.
Go over all these log files, specifically the ones I have in this lesson and see what type of different
logs.
There are many of them up for certain errors and get yourself familiar with them.
All right, guys, as we are going to analyzing and storing logs, there is one important thing that
we should not forget, which is maintaining accurate system time.
Maintaining system time is critical for a log file analysis across multiple system.
And the reason we maintain the accurate time is what if you're running, for example, a Web server
and that Web server behind the Web server, you have multiple servers that providing the service or
the actual horsepower to your Web site.
So something goes wrong, your website crashes, and now you have to review the logs, one system to
another.
And if your systems do not have the accurate time, then you're going to have a very hard time finding
out where and at what time the problem occurred.
That's why it's very important for multiple systems environment that you should maintain accurate system
time.
Also, having accurate time on a system is a requirement for sensitive applications such as database
in production environment.
The network time protocol short for A.P. is a standard way for machines to override and synchronize
a time to the A.P. server.
And A.P. server is a dedicated machine or a computer which responds to Clines four times synchronization
and crony D is the A.P. server or service just for time synchronization in the newer world Linux versions.
And why I say newer Linux version is because the older version had an TPD service by the acronym we
will cover right after this lecture.
So stay tuned.
Now, again, to maintain this accurate time, we have given a different a tool.
The number one tool that we use is the date, which is a very simple command that we use.
So I have my Linux machine open right now.
You just run the date and it will give you the date, the time and the month and all the information.
And you could use that same date command to change your time or date.
But now we have a new command, which is called a Time Date CTL, and that is not only to set or see
a time and date, but also to check your A.P. setting.
So if you are on time, date CTL, you will see it'll give you a local universal RTC time, the time
zone.
As you can see, I am in America at the New York State and the Eastern Daylight Saving Time is the system
clock synchronization.
That's what Interpeace setting is and is telling it.
Yes, it is being synchronized A.P. service.
It is active and running and then moving on.
If you wanted to get help regarding this Pacific Command, then you could just simply do time.
A date ctl a dash, dash, hop.
And you will notice all the options that are given to you with that command help is just what we just
ran and other commands like Status Show to set the time, the time zone, the list of time zone, the
time sync status, all the information you could get it from that help command.
By the way, you can also on Man Time Date CTL and it could provide sorry, wrong command date CTL and
it could provide pretty much similar information about your command.
All right then.
Moving on to the next one to view the list of time zone that that are available to you and the system,
let's clear the screen and the command to run.
That is time date CTL again and list time zones.
And when you run it, you will get all the list of every country within their city that you could set
that time zone to.
And this list, by the way, is provided to you the first time and you are doing the Lennix installation.
So you could change it now if you want to.
So if you run the command at time, date again.
Sorry, I keep missing one letter time date, CTL right here, this time zone that can be changed and
that can be changed by the running the command time, a date set time zone space and then didn't zone
the name of the zone.
And it will change it to your desired time zone.
To set time or to set time and date.
You could use a command a time date.
CTL set time and hour, Kolan minutes, Colen seconds.
If you wanted to set the time ahead, the date, month and year, all you have to do is use the same
option set dash time within the year, the month and the date followed by the exact same format.
Our time, minutes and seconds.
Then you have to enable A.P. synchronization.
If you want your system clock to synchronize its time to another or external source, then you have
to make sure that you'd have time dates set.
A.P. to true.
So let's clear the screen.
Let's run this command CTL set dash A.P. true.
And that's it.
And it will start sinking it, which we already had it.
Now, you cannot just sink to an A.P. server if you do not have any A.P. server running.
So for that, we go right straight to the next lecture and we'll show you how we could set up our Krasny
D, which is the A.P. service on our Linux system.
Chronic disease now chronic disease is a demon that is the latest version that is used nowadays to replace
an A.P. demon.
Now, why did they do it?
Because it probably have most enhanced features in it.
So we'll cover that ground in this lesson.
So the purpose of coroneted is, again, for time synchronization, the package name that you would
need to install or this program is called Cronie D.
The configuration file is at sea.
Hourani Dukkha for this is where you go in and specify the A.P. server now again and T.P is used to
synchronize your system clock with an external clock or any other clock within your organization that
serves as A.P..
So then we have a log file for chronic D daemon and a log file.
All the recording or all activity are is logged in to our log crony directory and then we have a service.
Of course, when you configure the chronic file, then you have to start a restart across an service
and the program command that you could run at Cronie C, which will tell you which A.P. clock you are
synched with and what's the status of it.
So let's look at our Lennix machine again and we'll try out this new feature, this new program that
is used in RedHat and S.O.S.
OK, so I have logged in as myself to our Linux machine and of course through console, see who we are,
you know, ourself.
Which host are we on?
We are on our correct hosts machine.
Now I want you to become Whoot.
OK, now check if we have the package
and the package name is Kranti date.
So it's R.P.M. minus Kuai again.
R.P.M. is a script that will list all the programs that we have at the minus option Q and A and we'll
grab for granted.
And when you enter.
I think it's just like cronie, I believe, ready?
Yes, OK, so I have confirmed that I do have the quantized package.
So package of course.
Now, what's the next step we always do once we have the package installed, we configure it right?
So let's go into our configuration file, which is etsi granny dot com file hit enter and we would have
to go to the library says.
This is where you define your A.P. server.
And as you see the first or second there, there are four servers that automatically divide and these
are the actual servers.
Set it up by S.O.S.
Let's put a new line and I'm going to have this server as Google Adelaida eight.
So, of course, this is not an A.P. server by Google.
This is just a DNS.
But just for practice and training purposes, I'm just putting that in.
So this is when we check the status will see it is connecting to the Google and any way you escape out
of it and do right in quick how you saved it.
Now, the next step is you have to start service.
So to start the service first check if the service is running system CTO
status on D and it says right here, it says inactive.
OK, so we have to make it active.
But also one thing I wanted to mention that please do not run and type and quantity at the same time.
So check the status of A.P. as well.
Sorry, antipode.
And if it is running, I recommend you to stop it.
So it is running as you could see here.
Right here, it says active.
So let's stop because we don't want to run to services that performs or that serves the same purpose.
Let's do status and stop now.
It has stopped the A.P. just verify it and it says inactive.
Right?
OK, good.
Now also, I wanted to disable it so it does not get started at the time.
At the time the disable and now it is there.
So now I could go ahead and do sys ctrl start.
Chronic, OK, it has started.
Let's check the status, OK?
It is active.
OK, now we have to enable it so it gets started at Bhuti.
It is enabled now.
OK, so now the program that comes with this package, it's called Chron EDC.
So it's Cronie Spatt and then CCE.
I think it stands for Command Kro Chronic C..
And when you hit enter it will bring you into an interactive mode of program mode of its own chronic
crisis.
Now when you type helped, you see there's so many commands that you can run within this program.
But the one that I wanted to run, it's called sources.
So this will tell us where did it go?
Right here.
So this will tell us which A.P. server we are connecting to.
So I'll type this command.
So while I'm in Chronixx, so its sources enter and you will see right here the first one, if you guys
remember that I picked eight eight eight eight.
So this is the Google server that we are sinking our time to.
And of course, this is not actually A.P. So I just picked it for training purposes so you could exit
out of it.
I think it's quick and I will go ahead and modify my cri de Aponte, compile again and I will remove
this first line once it's removed.
This way, I'm not hitting.
Google had Denisova for some different purpose anyway.
So now it's modified, removed and now to restart on the servers because we just modified the configuration
file.
Every time you modify configuration file, we have to restart its service.
Now we're under scrutiny again and now you do sources and you will see now it's going to a different
server which is defined in there depending on what is it resolving to.
So that's the topic about chronic disease.
Again, it's a replacement for A.P. It has newer features.
You can look it up online.
What are the new features and what's the difference between A.P. and Clonidine?