Linux 日志管理

操作系统内核和程序记录了发生的事件日志，这些日志用于审核系统并解决问题。日志以文本方式保存在/var/log目录中。可以使用普通文本实用程序（如less和tail）检查这些日志。

Linux 内置了基于Syslog协议的标准日志记录系统。许多程序使用此系统记录事件并将其组织到日志文件中。CentOS 7 中systemd-journald和rsyslog服务负责处理syslog消息。

• systemd-journald 服务，是操作系统事件记录体系结构的核心，收集系统各方面事件消息，包括内核、引导过程早期阶段的输出、守护程序启动和运行时的输出、syslog事件，然后将它们重组为标准格式，并写入结构化的索引系统日志中。
• rsyslog 服务，读取systemd-journald日志，然后记录到日志文件，或根据自己的配置将日志保存到不同的文件中，以及转发给其他程序。

rsyslog 日志配置

rsyslog 服务配置

日志记录规则

每一条日志消息都可以通过消息类型facility和priority分类。

日志记录规则格式: facility+连接符号+priority 处理方式

facility（设备类型）

priority（优先级）

连接符

处理方式

• 记录到文件
• 发送到终端
• 转发给其他服务器

查看日志内容

#查看sshd服务启动情况
[root@server ~ 11:36:23]# tail -f /var/log/messages
Sep 15 11:35:59 server sshd: /etc/ssh/sshd_config: line 141: Bad configuration option: hello
Sep 15 11:35:59 server sshd: /etc/ssh/sshd_config: terminating, 1 bad configuration options
Sep 15 11:35:59 server systemd: sshd.service: main process exited, code=exited, status=255/n/a
Sep 15 11:35:59 server systemd: Failed to start OpenSSH server daemon.
Sep 15 11:35:59 server systemd: Unit sshd.service entered failed state.
Sep 15 11:35:59 server systemd: sshd.service failed.
Sep 15 11:36:15 server systemd: Stopped OpenSSH server daemon.
Sep 15 11:36:15 server systemd: Starting OpenSSH server daemon...
Sep 15 11:36:16 server systemd: Started OpenSSH server daemon.
Sep 15 11:40:01 server systemd: Started Session 29 of user root.



Sep 15 11:49:04 server systemd: Stopping OpenSSH server daemon...
Sep 15 11:49:04 server systemd: Stopped OpenSSH server daemon.
Sep 15 11:49:04 server systemd: Starting OpenSSH server daemon...
Sep 15 11:49:04 server systemd: Started OpenSSH server daemon.

#查看用户切换情况
[root@server ~ 17:06:34]# tail -f /var/log/secure
Sep 15 17:00:48 server sshd[107909]: Server listening on 0.0.0.0 port 22.
Sep 15 17:00:48 server sshd[107909]: Server listening on :: port 22.
Sep 15 17:00:48 server polkitd[797]: Unregistered Authentication Agent for unix-process:107901:2903506 (system bus name :1.311, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) (disconnected from bus)
Sep 15 17:02:24 server polkitd[797]: Registered Authentication Agent for unix-process:110014:2913174 (system bus name :1.314 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)
Sep 15 17:02:24 server sshd[107909]: Received signal 15; terminating.
Sep 15 17:02:24 server polkitd[797]: Unregistered Authentication Agent for unix-process:110014:2913174 (system bus name :1.314, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) (disconnected from bus)
Sep 15 17:04:44 server polkitd[797]: Registered Authentication Agent for unix-process:113037:2927108 (system bus name :1.315 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)
Sep 15 17:04:44 server sshd[113044]: Server listening on 0.0.0.0 port 22.
Sep 15 17:04:44 server sshd[113044]: Server listening on :: port 22.
Sep 15 17:04:44 server polkitd[797]: Unregistered Authentication Agent for unix-process:113037:2927108 (system bus name :1.315, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) (disconnected from bus)




Sep 15 17:07:43 server sshd[116920]: Accepted publickey for root from 10.1.8.12 port 60094 ssh2: RSA SHA256:GstC3koMiQ39phFgv2hafxIBvnD7sweZpLkZfVJR9pA
Sep 15 17:07:43 server sshd[116920]: pam_unix(sshd:session): session opened for user root by (uid=0)
Sep 15 17:07:53 server su: pam_unix(su-l:session): session opened for user yang by root(uid=0)



Sep 15 17:08:06 server su: pam_unix(su-l:auth): authentication failure; logname=root uid=1000 euid=0 tty=pts/2 ruser=yang rhost=  user=root
Sep 15 17:08:06 server su: pam_succeed_if(su-l:auth): requirement "uid >= 1000" not met by user "root"

日志内容说明：

• Sep 15 11:35:59，代表日志产生时间。
• server，产生日志的主机名。
• sshd，产生日志的进程。
• 最后一个区域是日志内容，例如，“Removed session 15.”。

[root@server ~ 11:50:25]# tail -f /var/log/secure
Sep 15 11:34:34 server polkitd[797]: Unregistered Authentication Agent for unix-process:75582:946319 (system bus name :1.140, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) (disconnected from bus)
Sep 15 11:36:15 server polkitd[797]: Registered Authentication Agent for unix-process:77774:956439 (system bus name :1.141 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)
Sep 15 11:36:16 server sshd[77781]: Server listening on 0.0.0.0 port 22.
Sep 15 11:36:16 server sshd[77781]: Server listening on :: port 22.
Sep 15 11:36:16 server polkitd[797]: Unregistered Authentication Agent for unix-process:77774:956439 (system bus name :1.141, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) (disconnected from bus)
Sep 15 11:49:04 server polkitd[797]: Registered Authentication Agent for unix-process:94338:1033251 (system bus name :1.144 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8)
Sep 15 11:49:04 server sshd[77781]: Received signal 15; terminating.
Sep 15 11:49:04 server sshd[94346]: Server listening on 0.0.0.0 port 22.
Sep 15 11:49:04 server sshd[94346]: Server listening on :: port 22.
Sep 15 11:49:04 server polkitd[797]: Unregistered Authentication Agent for unix-process:94338:1033251 (system bus name :1.144, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) (disconnected from bus)

故障模拟

故障1：配置文件丢失

[root@server ~ 16:56:38]# mv /etc/ssh/sshd_config  .
# 重启服务时，动态监控日志
[root@server ~ 16:57:01]# systemctl restart sshd
'Job for sshd.service failed because the control process exited with error code. See "systemctl status sshd.service" and "journalctl -xe" for details.

#通过日志发现 /etc/ssh/sshd_config: No such file or directory，文件丢失。
[root@server ~ 16:58:01]# journalctl -e | tail -n 5
9月 15 16:57:57 server.cloud sshd[104168]: /etc/ssh/sshd_config: No such file or directory
9月 15 16:57:57 server.cloud systemd[1]: sshd.service: main process exited, code=exited, status=1/FAILURE
9月 15 16:57:57 server.cloud systemd[1]: Failed to start OpenSSH server daemon.
9月 15 16:57:57 server.cloud systemd[1]: Unit sshd.service entered failed state.
9月 15 16:57:57 server.cloud systemd[1]: sshd.service failed.

# 移动回来，并重启服务
[root@server ~ 17:00:34]# mv sshd_config /etc/ssh/
[root@server ~ 17:00:44]# systemctl restart sshd
[root@server ~ 17:00:48]# systemctl status sshd
● sshd.service - OpenSSH server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since 一 2025-09-15 17:00:48 CST; 10s ago
     Docs: man:sshd(8)
           man:sshd_config(5)
 Main PID: 107909 (sshd)
    Tasks: 1
   CGroup: /system.slice/sshd.service
           └─107909 /usr/sbin/sshd -D

9月 15 17:00:48 server.cloud systemd[1]: Stopped OpenSSH server daemon.
9月 15 17:00:48 server.cloud systemd[1]: Starting OpenSSH server daemon...
9月 15 17:00:48 server.cloud sshd[107909]: Server listening on 0.0.0.0 port 22.
9月 15 17:00:48 server.cloud sshd[107909]: Server listening on :: port 22.
9月 15 17:00:48 server.cloud systemd[1]: Started OpenSSH server daemon.

故障2：配置文件参数错误

[root@server ~ 17:00:58]# echo 'hello world' >> /etc/ssh/sshd_config
[root@server ~ 17:02:21]# systemctl restart sshd
Job for sshd.service failed because the control process exited with error code. See "systemctl status sshd.service" and "journalctl -xe" for details.

#通过日志发现/etc/ssh/sshd_config: line 141: Bad configuration option: hello.
[root@server ~ 17:02:24]# journalctl -e | tail
9月 15 17:02:24 server.cloud systemd[1]: Stopping OpenSSH server daemon...
9月 15 17:02:24 server.cloud systemd[1]: Stopped OpenSSH server daemon.
9月 15 17:02:24 server.cloud systemd[1]: Starting OpenSSH server daemon...
9月 15 17:02:24 server.cloud sshd[110022]: /etc/ssh/sshd_config: line 141: Bad configuration option: hello
9月 15 17:02:24 server.cloud sshd[110022]: /etc/ssh/sshd_config: terminating, 1 bad configuration options
9月 15 17:02:24 server.cloud systemd[1]: sshd.service: main process exited, code=exited, status=255/n/a
9月 15 17:02:24 server.cloud systemd[1]: Failed to start OpenSSH server daemon.
9月 15 17:02:24 server.cloud systemd[1]: Unit sshd.service entered failed state.
9月 15 17:02:24 server.cloud systemd[1]: sshd.service failed.
9月 15 17:02:24 server.cloud polkitd[797]: Unregistered Authentication Agent for unix-process:110014:2913174 (system bus name :1.314, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) (disconnected from bus)

Agent for unix-process:110014:2913174 (system bus name :1.314, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale zh_CN.UTF-8) (disconnected from bus)