Red Hat System Administration II

Bookmark this page
P1234567891011121314
PreviousNext

Guided Exercise: Review Syslog Files

Reconfigure the rsyslog service to write specific log messages to a new file.

Outcomes

  • Configure the rsyslog service to write all log messages with the debug priority to the /var/log/messages-debug log file.

As the student user on the workstation machine, use the lab command to prepare your system for this exercise.

This command prepares your environment and ensures that all required resources are available.

[student@workstation ~]$ lab start logs-syslog

Instructions

  1. Log in to the servera machine as the student user and switch to the root user.

    [student@workstation ~]$ ssh student@servera
...output omitted...
[student@servera ~]$ sudo -i
[sudo] password for student: student
[root@servera ~]#

  2. Configure the rsyslog service on the servera machine to log all messages with the debug or higher priority, for any service to the new /var/log/messages-debug log file by changing the /etc/rsyslog.d/debug.conf configuration file.

    1. Create the /etc/rsyslog.d/debug.conf file with the necessary entries to redirect all log messages with the debug or higher priority to the /var/log/messages-debug log file.

      *.debug /var/log/messages-debug

      This configuration line logs syslog messages with any facility and with the debug or higher priority level:

      • The wildcard (*) in the facility field of the configuration line indicates any facility of log messages.

      • The rsyslog service writes the matching messages to the /var/log/messages-debug log file.

    2. Restart the rsyslog service.

      [root@servera ~]# systemctl restart rsyslog

  3. Verify that all the log messages with the debug priority appear in the /var/log/messages-debug log file.

    1. Generate a log message with the user type and the debug priority.

      [root@servera ~]# logger -p user.debug "Debug Message Test"

    2. View the last ten log messages from the /var/log/messages-debug log file, and verify that you see the Debug Message Test message among the other log messages.

      [root@servera ~]# tail /var/log/messages-debug
Feb 13 18:22:38 servera systemd[1]: Stopping System Logging Service...
Feb 13 18:22:38 servera rsyslogd[25176]: [origin software="rsyslogd" swVersion="8.37.0-9.el8" x-pid="25176" x-info="http://www.rsyslog.com"] exiting on signal 15.
Feb 13 18:22:38 servera systemd[1]: Stopped System Logging Service.
Feb 13 18:22:38 servera systemd[1]: Starting System Logging Service...
Feb 13 18:22:38 servera rsyslogd[25410]: environment variable TZ is not set, auto correcting this to TZ=/etc/localtime  [v8.37.0-9.el8 try http://www.rsyslog.com/e/2442 ]
Feb 13 18:22:38 servera systemd[1]: Started System Logging Service.
Feb 13 18:22:38 servera rsyslogd[25410]: [origin software="rsyslogd" swVersion="8.37.0-9.el8" x-pid="25410" x-info="http://www.rsyslog.com"] start
Feb 13 18:27:58 servera root[25416]: Debug Message Test

    3. Return to the workstation system as the student user.

      [root@servera ~]# exit
logout
[student@servera ~]$ exit
logout
Connection to servera closed.
[student@workstation ~]$

Finish

On the workstation machine, change to the student user home directory and use the lab command to complete this exercise. This step is important to ensure that resources from previous exercises do not impact upcoming exercises.

[student@workstation ~]$ lab finish logs-syslog

PreviousNext
Revision: rh134-9.3-5fd2368