1. Cosc 4750
Log files

2. Logging policies Throw away all data immediately
Reset log files at periodic intervals
Rotate logs files, keeping data for a fixed time
Compress and archive logs to tape or other permanent media

3. Throwing away logs Not recommended
Needed for tuning/fixing the system
Keeping no logs, or turning off logs
linking log files to /dev/null
UNIX version of the trash can

4. Rotating log files Standard practice and default for installs
A log file is used for a specific time or until goes to a specific amount.
Then the log is renamed to logfile.1
usually, between 2 and 4 rotates
logfile, logfile.1,logfile.2, logfile.3, and logfile.4
Never version now use dates, instead of number. More useful?
When a log files reaches it last “rotate” it then removed/deleted

5. Archiving logs
The logs are usually compressed at certain times (or rotated logs)
probably with gzip or compress
Then stored on tape or other permanent media, off-line

6. Log files Commonly found in /var/log or /var/adm (sgi)
messages (SYSLOG or syslog)
Main system log, much of the system logs are found here
secure: network connections and auth logs
maillog: sendmail logs
xferlog: the ftp log
boot.log: output from the rc scripts
dmesg: kernel and init boot output
many others

7. syslog/messages
syslogd is the logging daemon, configured with /etc/syslog.conf (redhat 6)
Redhat 7: rsyslogd and /etc/rsyslog.conf
It can be configured to write logs to any number of files as well as duplicate log files
default it writes to SYSLOG/messages

8. syslogd.conf
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;news.none;authpriv.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* /var/log/maillog
# Everybody gets emergency messages, plus log them on another
# machine
*.emerg *
Rsyslog.conf is similar but also has a rsyslog.d directory include as well.

9. Syslog severity levels
emerg = Panic situations
alert = Urgent
crit = critical condition
err = other error conditions
warnings = warnings messages
notice = might merit investigation
info = information messages
debug = for debugging only

10. Other software uses syslog
ftpd, halt/reboot, inetd, login/rlogind
named, passwd, popper (mail), sendmail,
cron, vmunix (kernel)

11. logrotate command
uses configuration files to figure out when to rotate logs
/etc/logrotate.conf is a generic config
general info, when to rotate, compress, etc.
contains /var/log/wtmp rotate info
/etc/logrotate.d/ contains files for specific configures actions for logs rotations.

12. syslog rotate file
/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript }

13. Viewing log files
Most UNIX/linux log files contain lots of information.
Sometimes too much for people.
Besides cat’ing the logs in /var/log
There is a logviewer (system-logviewer)
redhat-logviewer on older redhat systems
There are many “logviewers” created by the OpenSource community.

14. logwatch A program installed by default on Redhat/Fedora systems.
s "important" logs information to the root account daily.
Configured in /etc/log.d directory
logwatch.conf is general configurations
services/* contains configuration files for varying services log files
logfiles/* contains config's for non-services log files
scripts/shared/*, scripts/services/* scripts/logfiles/* vary filters for services and non-services log files.

15. logSentry
Similar to logwatch, but driven by security concerns, where as logwatch is summary of the logs.
Filters out messages that are not security threats, then categorizes messages that could represent a threat and s.
Active System Attack Alters
Security Violations
Unusual system events.

16. Q A
&