Goal	Locate and accurately interpret system event logs for troubleshooting purposes.
Objectives	Describe the basic Red Hat Enterprise Linux logging architecture to record events. Interpret events in the relevant syslog files to troubleshoot problems or to review system status. Find and interpret entries in the system journal to troubleshoot problems or review system status. Configure the system journal to preserve the record of events when a server is rebooted. Maintain accurate time synchronization with Network Time Protocol (NTP) and configure the time zone to ensure correct time stamps for events that are recorded by the system journal and logs.
Sections	Describe System Log Architecture (and Quiz) Review Syslog Files (and Guided Exercise) Review System Journal Entries (and Guided Exercise) Preserve the System Journal (and Guided Exercise) Maintain Accurate Time (and Guided Exercise)
Lab	Analyze and Store Logs

Describe System Log Architecture

Objectives

Describe the basic Red Hat Enterprise Linux logging architecture to record events.

System Logging

The operating system kernel and other processes record a log of events that happen when the system is running. These logs are used to audit the system and to troubleshoot problems. You can use text utilities such as the less and tail commands to inspect these logs.

Red Hat Enterprise Linux uses a standard logging system that is based on the syslog protocol to log the system messages. Many programs use the logging system to record events and to organize them into log files. The systemd-journald and rsyslog services handle the syslog messages in Red Hat Enterprise Linux 9.

The systemd-journald service is at the heart of the operating system event logging architecture. The systemd-journald service collects event messages from many sources:

System kernel
Output from the early stages of the boot process
Standard output and standard error from daemons
Syslog events

The systemd-journald service restructures the logs into a standard format and writes them into a structured, indexed system journal. By default, this journal is stored on a file system that does not persist across reboots.

The rsyslog service reads syslog messages that the systemd-journald service receives from the journal when they arrive. The rsyslog service then processes the syslog events, and records them to its log files or forwards them to other services according to its own configuration.

The rsyslog service sorts and writes syslog messages to the log files that do persist across reboots in the /var/log directory. The service also sorts the log messages to specific log files according to the type of program that sent each message and the priority of each syslog message.

In addition to syslog message files, the /var/log directory contains log files from other services on the system. The following table lists some useful files in the /var/log directory.

Table 3.1. Selected System Log Files

Log file	Type of stored messages
`/var/log/messages`	Most syslog messages are logged here. Exceptions include messages about authentication and email processing, scheduled job execution, and purely debugging-related messages.
`/var/log/secure`	Syslog messages about security and authentication events.
`/var/log/maillog`	Syslog messages about the mail server.
`/var/log/cron`	Syslog messages about scheduled job execution.
`/var/log/boot.log`	Non-syslog console messages about system startup.

Some applications do not use the syslog service to manage their log messages. For example, the Apache Web Server saves log messages to files in a subdirectory of the /var/log directory.

References

systemd-journald.service(8), rsyslogd(8), and rsyslog.conf(5) man pages

For more information, refer to the Troubleshooting Problems Using Log Files section in the Red Hat Enterprise Linux 9 Configuring Basic System Settings guide at https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html-single/configuring_basic_system_settings/index

Discuss Red Hat System Administration II

Go to community

Is It possible to reset root password when the system is on multi-user.target?

jennifer1987

27 lip 2023

Hi thereWell, i have a question, Is It possible to reset root password when the system is on multi-user.target? I was not be able to found a foro o some information related with this and another question that I have, If the grub menu dont show up, is it posible to reset the root password?

991

Red Hat System Administration II (RH134)

Haley_Ruccio

21 lip 2023

Build the skills to perform the key tasks needed to become a full-time Linux administratorRed Hat System Administration II (RH134) is the second part of the RHCSA training track for IT professionals who have already attended Red Hat System Administration I. The course goes deeper into core Linux system administration skills in storage configuration and management, installation and deployment of Red Hat Enterprise Linux, management of security features such as SELinux, control of recurring system tasks, management of the boot process and troubleshooting, basic system tuning, and command-line automation and productivity. This course assumes that students have attended Red Hat System Administration I (RH124).Experienced Linux administrators who seek rapid preparation for the RHCSA certification should instead start with RHCSA Rapid Track (RH199).This course is based on Red Hat Enterprise Linux 9.0.Course summaryInstall Red Hat Enterprise Linux using scalable methodsAccess security files, file systems, and networksExecute shell scripting and automation techniquesManage storage devices, logical volumes, and file systemsManage security and system accessControl the boot process and system servicesRun containersAudience for this courseThis course is geared toward Windows system administrators, network administrators, and other system administrators who are interested in supplementing current skills or backstopping other team members, in addition to Linux system administrators who are responsible for these tasks:Configuring, installing, upgrading, and maintaining Linux systems using established standards and proceduresProviding operational supportManaging systems for monitoring system performance and availabilityWriting and deploying scripts for task automation and system administrationRecommended trainingSuccessful completion of Red Hat System Administration I (RH124) is recommended.Experienced Linux administrators seeking to accelerate their path toward becoming a Red Hat Certified System Administrator should start with the RHCSA Rapid Track course (RH199).Take our free assessment to gauge whether this offering is the best fit for your skills.Technology considerationsThere are no special technology requirements.This course is not designed for bring your own device (BYOD).Internet access is not required, but is recommended to allow students to research and access Red Hat online resources.

Welcome to the Red Hat System Administration II (RH134) group in the Red Hat Learning Community!

Deanna

18 lip 2023

We are excited to launch a space dedicated to the Red Hat Training course Red Hat System Administration II! To gain the most value from this group - click the "Join Group" button in the upper right hand corner.We encourage group members to collaborate in this group to discuss topics, ask questions, share best practices and tips, provide course feedback, and share their accomplishments as it relates to RH134.Read more about Red Hat System Administration II here.

417

Revision: rh134-9.3-5fd2368

Click CREATE to build all of the virtual machines needed for the classroom lab environment. This may take several minutes to complete. Once created the environment can then be stopped and restarted to pause your experience.

If you DELETE your lab, you will remove all of the virtual machines in your classroom and lose all of your progress.