一修改主机名称
hostnamectl set-hostname node1.example.com
二. /var/log/messages 日志
什么是日志
记录系统日常活动，也就是系统在什么时候由哪个进程做了什么样的行为，发生了何种事件。
日志文件的重要：（1) 解决系统方面的错误
（2）解决网络服务问题
（3）过往时间的记录
日志的生成：由各个程序生成
采集：1个程序进行采集
auth 用户登陆日至（pam程序产生的日至）
authpriv 服务认证日至（sshd）
kern 内核日志
cron 定时任务
lpr 打印相关信息
mail 邮件收发有关信息
news 新闻有关信息
user 用户相关程序
local 1-7 用户自定义
syslog 是由syslogd本身产生的信息
auth.debug /var/log/westos 将用户登陆的错误信息存放在/var/log/westos,这个文件中
auth.* /var/log/wes 将用户登陆的所有信息存放在wes中
日志信息等级
debug 系统调时
info 常规
err 报错（级别低，阻止了某个功能不能正常）
crit 阻止了整个软件和系统
alert 立即修改的信息
emerg 内核崩溃
none 不采集任何日志信息
系统常用
/var/log/messages 所有日志级别的常规信息（不包含邮件，服务认证，等）
/var/log/maillog 邮件的往来信息
/var/log/secure 服务认证，只要是输入帐号密码的软件，那么登陆时都会记录在此文件当中
/var/log/cron 定时任务
/var/log/dmesg 内核检测过程中的信息
/var/log/lastlog 系统上所有帐号最近一次登陆的相关信息
/var/log/wtmp 正确登陆系统者的帐号信息
/var/log/faillog 错误登陆时所产生的帐号信息
修改日志的目的
/etc/rsyslog.conf 修改日志的目的是为了让它去按照我们想要的方式去采集
日志的内容是由它本身决定,rsyslog.conf 是将日志里的内容进行采集并保存在内存中
定义日志采集格式vim /etc/rsyslog.conf
man 5 rsyslog.conf 可查看日志采集文件的参数
templates 采集格式
$template 名称,"日志采集格式”
$template westos,"%timegenerated% %FROMHOST_IP% %syslogtag% %msg%\n"
[root@localhost ~]# tail -n 10 /var/log/messages 查看后十行日志
Apr 19 06:30:01 localhost systemd: Starting Session 5 of user root.
Apr 19 06:30:01 localhost systemd: Started Session 5 of user root.
Apr 19 06:31:09 localhost rhsmd: In order for Subscription Manager to provide your system with updates, your system must be registered with the Customer Portal. Please enter your Red Hat login to ensure your system is up-to-date.
Apr 19 06:40:01 localhost systemd: Created slice user-0.slice.
Apr 19 06:40:01 localhost systemd: Starting Session 6 of user root.
Apr 19 06:40:01 localhost systemd: Started Session 6 of user root.
Apr 19 06:45:35 localhost systemd: Created slice user-0.slice.
Apr 19 06:45:35 localhost systemd: Starting Session 7 of user root.
Apr 19 06:45:35 localhost systemd: Started Session 7 of user root.
Apr 19 06:45:35 localhost systemd-logind: New session 7 of user root.
[root@localhost ~]# vim /etc/rsyslog.conf 打开日志文件
$template westos,"%FROMHOST-IP% %timegenerated% %syslogtag% %msg%\n"
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages;westos
[root@localhost ~]# systemctl restart rsyslog #重启采集文件
[root@localhost ~]# tail -n 10 /var/log/messages
127.0.0.1 Apr 19 06:54:49 rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [try http://www.rsyslog.com/e/2307 ]
127.0.0.1 Apr 19 06:54:49 systemd: Stopping System Logging Service...
127.0.0.1 Apr 19 06:54:49 systemd: Starting System Logging Service...
127.0.0.1 Apr 19 06:54:49 systemd: Started System Logging Service.
127.0.0.1 Apr 19 06:55:05 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="2547" x-info="http://www.rsyslog.com"] exiting on signal 15.
127.0.0.1 Apr 19 06:55:05 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="2556" x-info="http://www.rsyslog.com"] start
127.0.0.1 Apr 19 06:55:05 rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [try http://www.rsyslog.com/e/2307 ]
127.0.0.1 Apr 19 06:55:05 systemd: Stopping System Logging Service...
127.0.0.1 Apr 19 06:55:05 systemd: Starting System Logging Service...
127.0.0.1 Apr 19 06:55:05 systemd: Started System Logging Service.
2.日志的远程同步
为了方便处理文件，所以要将所有的日志放在同一个日志
日志发送方
vim /etc/rsyslog.conf
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
*.* @172.25.254.225
systemctl restart rsyslog 重启采集文件
在日志接收方
vim /etc/rsyslog.conf
打开UDP 接受端
# Provides UDP syslog reception
15 $ModLoad imudp #日志接受插件
16 $UDPServerRun 514 #日志接收接口
systemctl restart rsyslog #重启采集的文件，
systemctl stop firewalld #直接关闭防火墙
systemctl disable firewalld #开机不启动防火墙
[root@localhost ~]# tail -20 /var/log/messages
Apr 19 07:26:17 node2 rc.local: /etc/rc.d/rc.local: connect: No route to host
Apr 19 07:26:17 node2 rc.local: /etc/rc.d/rc.local: line 18: /dev/tcp/content.example.com/80: No route to host
Apr 19 07:26:23 node2 rc.local: /etc/rc.d/rc.local: connect: No route to host
Apr 19 07:26:23 node2 rc.local: /etc/rc.d/rc.local: line 18: /dev/tcp/content.example.com/80: No route to host
Apr 19 07:26:26 node2 rc.local: /etc/rc.d/rc.local: connect: No route to host
Apr 19 07:26:26 node2 rc.local: /etc/rc.d/rc.local: line 18: /dev/tcp/content.example.com/80: No route to host
Apr 19 07:26:32 node2 rc.local: /etc/rc.d/rc.local: connect: No route to host
Apr 19 07:26:32 node2 rc.local: /etc/rc.d/rc.local: line 18: /dev/tcp/content.example.com/80: No route to host
Apr 19 07:26:32 node1 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="2969" x-info="http://www.rsyslog.com"] exiting on signal 15.
Apr 19 07:26:32 node1 rsyslogd: [origin software="rsyslogd" swVersion="7.4.7" x-pid="2978" x-info="http://www.rsyslog.com"] start
Apr 19 07:26:32 node1 rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [try http://www.rsyslog.com/e/2307 ]
Apr 19 07:26:32 node1 systemd: Stopping System Logging Service...
Apr 19 07:26:32 node1 systemd: Starting System Logging Service...
Apr 19 07:26:32 node1 systemd: Started System Logging Service.
Apr 19 07:26:35 node2 rc.local: /etc/rc.d/rc.local: connect: No route to host
Apr 19 07:26:35 node2 rc.local: /etc/rc.d/rc.local: line 18: /dev/tcp/content.example.com/80: No route to host
Apr 19 07:26:41 node2 rc.local: /etc/rc.d/rc.local: connect: No route to host
Apr 19 07:26:41 node2 rc.local: /etc/rc.d/rc.local: line 18: /dev/tcp/content.example.com/80: No route to host
Apr 19 07:26:44 node2 rc.local: /etc/rc.d/rc.local: connect: No route to host
Apr 19 07:26:44 node2 rc.local: /etc/rc.d/rc.local: line 18: /dev/tcp/content.example.com/80: No route to host
做实验时首先将日志清空
> /var/log/messages
排错：（1） 火墙没关 systemctl status firewalld
（2）服务没重启 systemctl restart rsyslog
（3）配置文件写错了:根据错误排错
三、查看日志工具，直接查看内存中的日志
journalctl -n 3 最新3条日志
-p err 报错
-f 实时监控日志
-o verboes 查看日志的详细信息
journactl _pid=651
--since --untill 从什么时间到什么时间
[root@node59 ~]# journalctl --since 01:40 --until 01:51
systemd-journald
默认只对日志查看，而不对日志进行保存和采集,那么重启动，对日志进行查看，只能看到开机后的日志，系统之前的日志因为保存在内存中，那么关机后就被清空了，那么开机时用journal看不到
如何让 保存日志到硬盘
mkdir /var/log/journal
chgrp systemd-journald /var/log/journal
chmod g+s /var/log/journal
killall -l systemd-journald
journalctl -n 3
date
reboot
journalctl
四时间同步
在服务端共享时间
vim /etc/chrony.conf
29 local stratum 10 开启时间共享功能并设置共享级别
允许那个参数开启后本机不去同步别人的时间到本机
22 allow 172.25.254.0 允许那些客户端来访问本机共享的时间
systemctl restart chronyd
在客户端
vim /etc/chrony.conf
server 172.25.254.225 iburst
systemctl restart chronyd
chronyc sources -v
设定时间
timedatectl set-time
[root@node1 ~]# timedatectl set-timezone Asia/Shanghai
[root@node1 ~]# timedatectl
Local time: 六 2018-04-14 16:13:33 CST
Universal time: 六 2018-04-14 08:13:33 UTC
RTC time: 六 2018-04-14 08:13:34
Timezone: Asia/Shanghai (CST, +0800)
NTP enabled: yes
NTP synchronized: no
RTC in local TZ: no
DST active: n/a
[root@node1 ~]# timedatectl set-local-rtc 0
[root@node1 ~]# vim /etc/adjtime
0.0 0 0.0
0
UTC
[root@node1 ~]# timedatectl set-local-rtc 1
[root@node1 ~]# vim /etc/adjtime
0.0 0 0.0
0
LOCAL
五、时间延迟
at 时间
at now+5min
[root@localhost ~]# at 19:37
at> touch /mnt/file{1..10}
at> <EOT>
job 1 at Thu Apr 19 19:37:00 2018
[root@localhost ~]# at -l
1 Thu Apr 19 19:37:00 2018 a root
at -l #列出正在执行的信息
at -c 3 #列出正在执行的详情
at -r 3 #撤销
vim /etc/at.deny 黑名单：写入黑名单里的无法执行at命令
vim /etc/at.allow 白名单：写入白名单里的可以执行at命令，其他普通用户则不可以执行
如果同时写入黑名单和白名单，那么是可以执行的，取决于白名单
733
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
