In this lab, you will search for text in the system logs and the output of commands in order to find information more efficiently.
Outcomes
You should be able to efficiently search for text in log files and configuration files.
Log in to workstation as student using student as the password.
On workstation, run the lab console-regex start command.
This command runs a start script that determines if the servera machine is reachable on the network.
It also installs the postfix package.
[student@workstation ~]$lab console-regex start
Use the ssh command to log in to servera as the student user.
The systems are configured to use SSH keys for authentication, therefore a password is not required.
[student@workstation ~]$ssh student@servera...output omitted... [student@servera ~]$
Use the sudo -i command to switch to the root user.
The password for the student user is student.
[student@servera ~]$sudo -i[sudo] password for student:student[root@servera ~]#
The postfix package was installed today by the start script.
Use the grep
command to find the GID and UID for the postfix and postdrop groups and users.
To reduce the output of the grep command, display all logs from a specific Start Time.
Use the date command to determine the current time.
[root@servera ~]#dateFri Mar 22 08:23:56 CET 2019
Use the grep command with the date, start time, and GID options to find the postfix and postdrop user's GID and UID.
The lab set-up script ran a few minutes before the current time.
Take this into consideration when searching the /var/log/secure log file.
[root@servera ~]#grep '^Mar 22 08:20:04 servera groupadd[2514]: group added to /etc/group:Mar 22 08:2.*GID' /var/log/securename=postdrop, GID=90Mar 22 08:20:04 servera groupadd[2514]: new group: name=postdrop, GID=90 Mar 22 08:20:04 servera groupadd[2520]: group added to /etc/group:name=postfix, GID=89Mar 22 08:20:04 servera groupadd[2520]: new group: name=postfix, GID=89 Mar 22 08:20:04 servera useradd[2527]:new user: name=postfix, UID=89, GID=89, home=/var/spool/postfix, shell=/sbin/nologin
Modify your regular expression to locate the first two messages in the /var/log/maillog file.
Notice that in this search you are not using the caret character (^) because you are not searching for the first character in a line.
[root@servera ~]#grep 'postfix' /var/log/maillog | head -n 2Mar 22 08:21:02 serverapostfix/postfix-script[3879]: starting the Postfix mail system Mar 22 08:21:02 servera postfix/master[3881]:daemon started-- version 3.3.1, configuration /etc/postfix
You are required to find the name of the queue directory for the Postfix server.
Search the /etc/postfix/main.cf
configuration file for all information about queues.
Use the -i option to ignore case distinctions.
[root@servera ~]#grep -i 'queue' /etc/postfix/main.cf# testing. When soft_bounce is enabled, mail will remainqueued that # Thequeue_directory specifies the location of the Postfix queue.queue_directory = /var/spool/postfix#QUEUEAND PROCESS OWNERSHIP # The mail_owner parameter specifies the owner of the Postfixqueue# is the Sendmail-compatible mailqueuelisting command. # setgid_group: The group for mail submission andqueuemanagement
Confirm that postfix is writing messages to /var/log/messages.
Use the less command then the slash character (/) to search the file.
Press n to move to the next entry that matches the search.
Use the q key to quit the less command.
[root@servera ~]#less /var/log/messages...output omitted... Mar 22 07:58:04 servera systemd[1]: StartedPostfixMail Transport Agent. ...output omitted... Mar 22 08:12:26 servera systemd[1]: StoppingPostfixMail Transport Agent... Mar 22 08:12:26 servera systemd[1]: StoppedPostfixMail Transport Agent. ...output omitted... /Postfix
Use the ps aux command to confirm that the postfix server is currently running.
Reduce the output of ps aux by combining it with the grep command.
[root@servera ~]#ps aux | grep postfixroot 3881 0.0 0.2 121664 5364 ? Ss 08:21 0:00 /usr/libexec/postfix/master -wpostfix3882 0.0 0.4 147284 9088 ? S 08:21 0:00 pickup -l -t unix -upostfix3883 0.0 0.4 147336 9124 ? S 08:21 0:00 qmgr -l -t unix -u
Confirm that the qmgr, cleanup, and pickup queues are correctly configured.
Use the grep command with the -e option to match multiple entries in the same file.
The configuration file is /etc/postfix/master.cf
[root@servera ~]#grep -e qmgr -e pickup -e cleanup /etc/postfix/master.cfpickupunix n - n 60 1pickupcleanupunix n - n - 0cleanupqmgrunix n - n 300 1qmgr#qmgrunix n - n 300 1oqmgr
Log off from servera.
[root@servera ~]#exitlogout[student@servera ~]$exitlogout Connection to servera closed. [student@workstation ~]$
This concludes the guided exercise.