Ch11: Syslog and Logfiles Presented by: Apichana Thiantanawat 06/11/02

What are log files? Useful information about a system Usage of data Who, What, When, How Warnings and errors Two kinds of logs System logs Application logs

Why logs? We can monitor a system Misuses and abnormalities can be investigated from logs Logs are all evidences when a system has been compromised.

Unix’s Log Files Generated by many of Unix system processes Log files grow without bounds Eventually, you will run out disk space What to do? manage log files

Logging Policies Throw away log files Reset log files Rotate log files Archive log files

Throwing away log files Not recommend since accounting and logged data are useful in detection of: Break-ins or other questionable activity altering hardware and software problems Should keep for some time (1month) since you may not realize immediately that there is a problem.

Reset log files When log files get too big then reset the file to zero Pro You have data for troubleshooting Con Loose all history after deletion What if you reset the log file, then find a problem? You have no data to look at Average disk usage may be higher

Rotating log files Keep backup log files for fix time (daily,weekly, etc.) Store each day’s log on separate files ( logfile.1, logfile.2,..., logfile.7) Use script to rename the files to push older data toward the end of chain. The oldest log are deleted. Compress older files – using compress or other utilities

Example script for 3 day rotation #! /bin/sh cd/var/log mv logfile.2 logfile.3 mv logfile.1 logfile.2 mv logfile logfile.1 cat /dev/null > logfile Rotating log files (cont.)

Caution !! Some daemons keep log files open all time, which cause: Log data will disappear instead of going to the recreated log file. The older (original) log file still alive even after we delete it and create a new log with the same name. To install a new log file, such daemons must be signaled or killed and restarted. Rotating log files (cont.)

An example script for both compression and signals: #!/bin/sh cd /var/log mv logfile.2.gz logfile.3.gz mv logfile.1.gz logfile.2.gz mv logfile logfile1.gz cat /dev/null > logfile kill – signal pid gzip logfile.1 Rotating log files (cont.)

Archiving log files Compress and archive files to backup media All accounting data and log files may be archived usually for audit purposes First rotate to disk and then write to tape or other permanent media – faster access, reduces frequency of tape backups Can use normal backup or separate tapes. Note: may need to keep for longer than backups

Locations of log files Very inconsistent over vendors and daemons. Usually at /var/log, /var/adm, or /usr/adm To locate log file read system’s startup scripts (/etc/rc*, /etc/rc.d/*, or /etc/init.d/*) to see if logging is on and what file is used the locations of log files are usually given in /etc/syslog.conf

An example of log file acct: system accounting file, keeps a record for every process username who ran the command name of the command CPU time used completion timestamp of the process flag indicating completion status see table 11.1 p.208 for more examples of log files

Files not to manage /var/adm/lastlog records user's last login and is on sparse file format which will grow alarmingly if copied. Don’t copy it! /etc/utmp keeps a record of current logged in users

SYSLOG: a comprehensive logging system Used to manage the information generated by the kernel and the system utilities Two important functions: Liberates programmers from mechanics of writing log files Allows administrators to control logging effectively SYSLOG allows: Messages to be sorted by their important (severity) level Messages to be routed to log files, users’ terminals, or other machines

SYSLOG (cont.) Syslog consists of three parts: syslogd and /etc/syslog.conf : the daemon that does logging and its configuration file openlog, syslog, closelog: library routines that programmers use to send data to syslog logger: a user-level command for submitting log entries

Startup and configuration of Syslog Started up in the early stages of multi-user bootup. Runs as a daemon named syslogd /etc/syslog.conf contains syslog’s configurations and rules Facility names Severity levels Actions Modify /etc/syslog.conf must send a hangup signal to syslogd to make changes take effect

Syslog facilities Define in syslog.conf Facilities identify the program that is sending a log message: kern: message generated by kernel not by users user: message generated by user processes mail: the mail system local0-7: local machine

Identify in the syslog.conf Indicate the minimum importance that a message must have in order to be logged Syslog severity levels

LevelApproximate meaning emerg alert crit err warning notice info debug Panic situations Urgent situations Critical conditions Other error conditions Warning messages Might merit investigation Informational messages For debugging only

Syslog actions Filename : write the message to a file on the local send the message to the syslogd on : send the message to the host at address ipaddress user1,user2,... : write the message to users’ screens if they are logged in * : write the message to all users logged in

Configuring syslogd Basic format: selector action Selector: identify the facility and severity level facility.level action for example: mail.infor /var/log/maillog

Designing a logging scheme Small site keep logfiles on each machine Large network central logging host Information manageable should be a secure host other host sends most info to logging host

Debugging syslog Use logger to test changes in syslogd’s configuration files (syslog.conf) An example local5.warning /tmp/evi.log % logger –p local5.warning “test message”

Using syslog from programs The library routines openlog, syslog, and closelog allow programs to use the syslog system. Openlog initializes logging Syslog sends a message to syslogd Closelog closes the logging channel

Condensing log files Looking through logfiles, you’re likely to miss important data Solution: use some tools to filter Swatch Logcheck Promptly review Security-related messages Messages about disks Messages that are repeated many times