Logwatch,顾名思义,是一款专门监测Linux log文件(日志文件)的软件。安装以后只要稍微配置一下,就能每天将主机的log分析文件发送至指定的邮箱。为什么要这么做? 因为这样能节省一个个手动查看日志的繁琐,为管理员节省时间,节省精力。并且每天(甚至更频繁)都能准确地接收到日志。从而对服务器的安全情况有所掌握。
以下安装方法是在apt格式的Linux发行版下安装(比如Debian、ubuntu等)
运行命令:apt-get install logwatch
netren:~# apt-get install logwatch
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
libdate-manip-perl
Suggested packages:
fortune-mod
The following NEW packages will be installed:
libdate-manip-perl logwatch
0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
Need to get 499kB of archives.
After this operation, 2871kB of additional disk space will be used.
Do you want to continue [Y/n]?y(按y键继续,完成安装)
安装后版本是logwatch 7.3.6,并在Linux系统内生成以下文件:
/etc/logwatch (所在目录)
/etc/cron.daily/00logwatch (自动生成的日程,根据此项系统每天进行日志检查)
/usr/sbin/logwatch (logwatch命令文件)
/usr/share/logwatch/ (程序安装的位置)
/usr/share/logwatch/scripts/logwatch.pl (logwatch主文件)
/usr/sbin/logwatch (logwatch命令)
/usr/share/logwatch/default.conf/services/sshd.conf(针对sshd程序日志的管理)
/usr/share/logwatch/default.conf/services/sshd2.conf
/usr/share/logwatch/default.conf/services/stunnel.conf
...........
/usr/share/logwatch/dist.conf/logfiles
/usr/share/logwatch/dist.conf/logwatch.conf (logwatch配置文件)
logwatch配置:
vim /usr/share/logwatch/dist.conf/logwatch.conf
查找 MailTo = ,然后改为你的实际Email地址,比如 MailTo = guo@netren.org
Detail = 是信息等级,推荐 10 ,即最高。
: qw 存盘退出。logwatch默认为每天执行一次(cron.daily)。当然也可以用命令立即执行:
netren:~#/usr/sbin/logwatch --mailto 你的邮箱
>>>阅读全文
转载于:https://blog.51cto.com/netren/592104