RHCSA Rapid Track

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
.emerg                                                 :omusrmsg:

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

The logrotate command rotates log files to prevent them from taking too much space in the /var/log directory. When a log file is rotated, it is renamed with an extension that indicates the rotation date. For example, the previous /var/log/messages file is renamed to the /var/log/messages-20220320 file when it is rotated on 2022-03-20. After the previous log file rotates, it creates a log file and notifies the service that wrote the log file.

After rotations during typically four weeks, the earliest log file is discarded to free disk space. A scheduled job runs the logrotate command daily to see the rotation requirement of any log files. Most log files rotate weekly; the logrotate command rotates some log files faster, or more slowly, or when they reach a specific size.

Log messages start with the earliest message at the start and the latest message at the end of the log file. The rsyslog service uses a standard format for recording entries in log files. The following example explains the anatomy of a log message in the /var/log/secure log file.

Mar 20 20:11:48 localhost sshd[1433]: Failed password for student from 172.25.0.10 port 59344 ssh2

Monitoring log files for events is helpful to reproduce issues. The tail -f /path/to/file command outputs the last ten lines of the specified file and continues to output newly written lines in the file.

For example, to monitor for failed login attempts, run the tail command in one terminal, and then run in another terminal the ssh command as the root user while a user tries to log in to the system.

In the first terminal, run the tail command:

[root@host ~]# tail -f /var/log/secure

In the second terminal, run the ssh command:

[root@host ~]# ssh root@hosta
root@hosta's password: redhat
...output omitted...
[root@hostA ~]#

The log messages are visible in the first terminal.

...output omitted...
Mar 20 09:01:13 host sshd[2712]: Accepted password for root from 172.25.254.254 port 56801 ssh2
Mar 20 09:01:13 host sshd[2712]: pam_unix(sshd:session): session opened for user root by (uid=0)

The logger command sends messages to the rsyslog service. By default, the logger command sends the message to the user type with the notice priority (user.notice) unless specified otherwise with the -p option. It is helpful to test any change to the rsyslog service configuration.

To send a message to the rsyslog service to be recorded in the /var/log/boot.log log file, execute the following logger command:

[root@host ~]# logger -p local7.notice "Log entry created on host"