基于Linux下的系统日志

实验一开始我们需要重启两台虚拟机，然后配置ip地址，然后在真机打开两个shell分别连接两个IP地址，将两台虚拟机名字分别改为node1和node2方便操作时进行辨认，本节课我们来学习日志。

更改名字命令如下：

 hostnamectl set-hostname node1.example.com

 hostnamectl set-hostname node2.example.com

1.日志采集规则：

用node1操作：日志存在于内存，rsyslog命令的意义在于将内存里面的东西收集放到硬盘里面。

[root@node1 ~]# > /var/log/messages           清空日志

[root@node1 ~]# cat /var/log/messages    

[root@node1 ~]# systemctl restart sshd.service     重启动

[root@node1 ~]# cat /var/log/messages              查看文件

Apr 13 21:59:19 localhost systemd: Stopping OpenSSH server daemon...

Apr 13 21:59:19 localhost systemd: Starting OpenSSH server daemon...

Apr 13 21:59:19 localhost systemd: Started OpenSSH server daemon.

[root@node1 ~]# systemctl stop rsyslog.service    停止收集日志的服务

[root@node1 ~]# > /var/log/messages

[root@node1 ~]# systemctl restart sshd.service

[root@node1 ~]# cat /var/log/messages             查看时候没有日志

[root@node1 ~]# systemctl start rsyslog.service   开始收集日志的服务

[root@node1 ~]# cat /var/log/messages

Apr 13 22:00:27 node1 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="30481" x-info="http://www.rsyslog.com"] start

Apr 13 22:00:27 node1 rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [try http://www.rsyslog.com/e/2307 ]

Apr 13 21:59:49 node1 systemd: Stopping System Logging Service...

Apr 13 21:59:49 node1 systemd: Stopped System Logging Service.

   

[root@node1 ~]# vim /etc/rsyslog.conf   编辑配置文件，把我们想保存的日志放在我们希望的目录中   *.* /var/log/westos

[root@node1 ~]# ls /var/log/westos

ls: cannot access /var/log/westos: No such file or directory

[root@node1 ~]# systemctl restart sshd.service

[root@node1 ~]# cat /var/log/westos

cat: /var/log/westos: No such file or directory

[root@node1 ~]# systemctl restart rsyslog.service 重启查看

[root@node1 ~]# cat /var/log/westos

Apr 13 22:03:25 node1 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="30596" x-info="http://www.rsyslog.com"] start

Apr 13 22:03:25 node1 rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [try http://www.rsyslog.com/e/2307 ]

Apr 13 22:03:25 node1 systemd: Stopping System Logging Service...

Apr 13 22:03:25 node1 systemd: Starting System Logging Service...

Apr 13 22:03:25 node1 systemd: Started System Logging Service.

在node2操作：

[root@node2 ~]# vim 第七天笔记

[root@node2 ~]# ssh root@172.25.254.121   连接第一台主机

root@172.25.254.121's password:

Last login: Fri Apr 13 22:11:07 2018 from 172.25.254.221

[root@node1 ~]# cat /var/log/westos       查看配置文件

Apr