一、日志分类和优先级总结
1.1,日志分类
日志类型 | 作用 | 存放位置 |
系统日志 | 记录系统运行中的事件 | /var/log/syslog(messages) |
认证日志 | 记录用户认证信息 | /var/log/auth.log(secure) |
程序日志 | 记录应用程序的日志信息 | /var/log/程序名 |
用户日志 | 记录用户级别的事件 | /var/log/userlog(wtmp) |
启动日志 | 记录系统启动和关闭过程中的日志 | /var/log/boot.log(boot) |
1.2,日志优先级
从 低 到 高 | debug | 记录详细的调试信息 |
info | 记录程序运行的一般信息 | |
notice | 记录程序正常运行但是重要的信息 | |
warn | 记录可能会影响程序正常运行但不会导致程序停止的信息 | |
err | 记录程序运行中的错误信息 | |
crit | 记录临界条件信息 | |
alert | 记录必须立即执行的行动 | |
emerg | 记录程序运行中的严重错误 |
二、实例:SSH日志的rsyslog应用
2.1,实例1-ssh日志通过rsyslog写入特定文件
[root@Rocky-test1 ~]# vim /etc/ssh/sshd_config #配置sshd服务日志类别
SyslogFacility local6
[root@Rocky-test1 ~]# systemctl restart sshd[root@Rocky-test1 ~]# touch /var/log/ssh.log
[root@Rocky-test1 ~]# vim /etc/rsyslog.conf #local6的info级别以上信息写入指定文件
local6.info /var/log/ssh.log[root@Rocky-test1 ~]# systemctl restart syslog.service #重启服务生效
2.2,实例2-多台服务器ssh日志集中写入单一文件
将Rocky-test1,ubuntu-test1和ubuntu-test2的ssh日志写入ubuntu-test2服务器内
#Rocky-test1配置
[root@Rocky-test1 ~]# vim /etc/ssh/sshd_config
SyslogFacility AUTH
[root@Rocky-test1 ~]# vim /etc/rsyslog.conf #开启udp
module(load="imudp") # needs to be done just once
input(type="imudp" port="514")auth.info @10.0.0.162
[root@Rocky-test1 ~]# systemctl restart sshd
[root@Rocky-test1 ~]# systemctl restart rsyslog.service
#ubuntu-test1配置
root@ubuntu-test1:~# vim /etc/ssh/sshd_config
SyslogFacility AUTH
root@ubuntu-test1:~# systemctl restart sshd
root@ubuntu-test1:~# vim /etc/rsyslog.conf
module(load="imudp")
input(type="imudp" port="514")
auth.info @10.0.0.162:514
root@ubuntu-test1:~# systemctl restart rsyslog.service#ubuntu-test2配置
root@ubuntu-test2:/var/log# vim /etc/rsyslog.conf
module(load="imudp")
input(type="imudp" port="514")
root@ubuntu-test2:/var/log# systemctl restart rsyslog.service#Rocky-test1,ubuntu-test1退出重新登录
root@ubuntu-test2:/var/log# tail -f /var/log/auth.log
Jun 4 10:17:47 Rocky-test1 systemd-logind[994]: Session 12 logged out. Waiting for processes to exit.
Jun 4 10:17:47 Rocky-test1 systemd-logind[994]: Removed session 12.
Jun 4 10:17:47 Rocky-test1 systemd-logind[994]: Session 13 logged out. Waiting for processes to exit.
Jun 4 10:17:47 Rocky-test1 systemd-logind[994]: Removed session 13.
Jun 4 10:17:51 Rocky-test1 sshd[26614]: Accepted password for root from 10.0.0.1 port 57706 ssh2
Jun 4 10:17:51 Rocky-test1 systemd-logind[994]: New session 14 of user root.
Jun 4 10:17:51 Rocky-test1 sshd[26616]: Accepted password for root from 10.0.0.1 port 57707 ssh2
Jun 4 10:17:51 Rocky-test1 systemd-logind[994]: New session 15 of user root.
Jun 4 10:30:25 ubuntu-test1 systemd-logind[810]: Session 19 logged out. Waiting for processes to exit.
Jun 4 10:30:25 ubuntu-test1 systemd-logind[810]: Removed session 19.
Jun 4 10:30:25 ubuntu-test1 systemd-logind[810]: Session 20 logged out. Waiting for processes to exit.
Jun 4 10:30:25 ubuntu-test1 systemd-logind[810]: Removed session 20.
Jun 4 10:30:29 ubuntu-test1 systemd-logind[810]: New session 42 of user root.
Jun 4 10:30:30 ubuntu-test1 systemd-logind[810]: New session 43 of user root.
三、总结journalctl命令
journalctl
-a #完整显示字段内容
-f #只显示最新的日志项,且不断显示新生成的日志
-n --line #限制显示最新的日志行数,默认为10
-r #反转日志行的输出顺序
-o #控制日志输出格式
-b --boot #显示特定于某次启动的日志
-k #仅显示内核日志
-S #显示晚于指定时间的日志
-U #显示早于指定时间的日志
-u --user-unit #仅显示属于特定用户会话单元的日志
-p --priority #根据日志优先级过滤输出结果
[root@Rocky-test1 ~]# journalctl -b -0
-- Logs begin at Mon 2024-06-03 11:18:35 CST, end at Mon 2024-06-03 11:21:17 CST. --
Jun 03 11:18:35 Rocky-test1 kernel: Linux version 4.18.0-372.9.1.el8.x86_64 (mockbuild@dal1-prod-builder001.bld.equ.roc>
Jun 03 11:18:35 Rocky-test1 kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-372.9.1.el8.x86_64 root=/dev/m>[root@Rocky-test1 ~]# journalctl -f
-- Logs begin at Mon 2024-06-03 11:18:35 CST. --
Jun 03 14:12:35 Rocky-test1 systemd[1]: dnf-makecache.service: Succeeded.
Jun 03 14:12:35 Rocky-test1 systemd[1]: Started dnf makecache.
[root@Rocky-test1 ~]# journalctl -k
-- Logs begin at Mon 2024-06-03 11:18:35 CST, end at Mon 2024-06-03 14:12:35 CST. --
Jun 03 11:18:35 Rocky-test1 kernel: Linux version 4.18.0-372.9.1.el8.x86_64 (mockbuild@dal1-prod-builder001.bld.equ.roc>
Jun 03 11:18:35 Rocky-test1 kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-372.9.1.el8.x86_64 root=/dev/m>
Jun 03 11:18:35 Rocky-test1 kernel: Disabled fast string operations
Jun 03 11:18:35 Rocky-test1 kernel: x86/fpu: x87 FPU will use FXSAVE
Jun 03 11:18:35 Rocky-test1 kernel: signal: max sigframe size: 1440
Jun 03 11:18:35 Rocky-test1 kernel: BIOS-provided physical RAM map:
[root@Rocky-test1 ~]# journalctl -S "2024-06-03 13:00:00"
-- Logs begin at Mon 2024-06-03 11:18:35 CST, end at Mon 2024-06-03 15:01:01 CST. --
Jun 03 13:01:02 Rocky-test1 CROND[1621]: (root) CMD (run-parts /etc/cron.hourly)
Jun 03 13:01:02 Rocky-test1 run-parts[1624]: (/etc/cron.hourly) starting 0anacron
Jun 03 13:01:02 Rocky-test1 run-parts[1630]: (/etc/cron.hourly) finished 0anacron
Jun 03 14:01:01 Rocky-test1 CROND[1639]: (root) CMD (run-parts /etc/cron.hourly)
Jun 03 14:01:01 Rocky-test1 run-parts[1642]: (/etc/cron.hourly) starting 0anacron
Jun 03 14:01:01 Rocky-test1 run-parts[1648]: (/etc/cron.hourly) finished 0anacron
Jun 03 14:12:35 Rocky-test1 systemd[1]: Starting dnf makecache...
Jun 03 14:12:35 Rocky-test1 dnf[1649]: Metadata cache refreshed recently.
Jun 03 14:12:35 Rocky-test1 systemd[1]: dnf-makecache.service: Succeeded.
Jun 03 14:12:35 Rocky-test1 systemd[1]: Started dnf makecache.
Jun 03 15:01:01 Rocky-test1 CROND[1669]: (root) CMD (run-parts /etc/cron.hourly)
Jun 03 15:01:01 Rocky-test1 run-parts[1672]: (/etc/cron.hourly) starting 0anacron
Jun 03 15:01:01 Rocky-test1 run-parts[1678]: (/etc/cron.hourly) finished 0anacron
四、实现多主机日志收集
将Rocky-test1,ubuntu-test1和ubuntu-test2的日志写入ubuntu-test2服务器内的数据库内
#在ubuntu-test2安装数据库和相关的rsyslog服务组件
root@ubuntu-test2:~# apt install -y mysql-server
root@ubuntu-test2:~# vim /etc/mysql/mysql.conf.d/mysqld.cnf#bind-address = 127.0.0.1 #Ubuntu需要注释掉这两行内容才能
#mysqlx-bind-address = 127.0.0.1 #远程连接数据库root@ubuntu-test2:~# systemctl restart mysql.service
root@ubuntu-test2:~# mysql
mysql> alter user root@'localhost' identified by 'Wlm@123';
Query OK, 0 rows affected (0.02 sec)
root@ubuntu-test2:~# apt update && apt -y install rsyslog-mysqlroot@ubuntu-test2:~# cat /etc/rsyslog.d/mysql.conf #查看并配置rsyslog-mysql配置
### Configuration file for rsyslog-mysql
### Changes are preservedmodule (load="ommysql")
*.* action(type="ommysql" server="localhost" db="Syslog" uid="rsyslog" pwd="Wlm@123")root@ubuntu-test2:~# mysql -uroot -h'localhost' #为rsyslog配置数据库
mysql> create user rsyslog@'localhost' identified by 'Wlm@123';
Query OK, 0 rows affected (0.15 sec)mysql> create database Syslog;
Query OK, 1 row affected (0.02 sec)mysql> grant all on Syslog.* to rsyslog@'localhost';
Query OK, 0 rows affected (0.00 sec)
root@ubuntu-test2:~# mysql -uroot -h'localhost' -b Syslog < /usr/share/dbconfig-common/data/rsyslog-mysql/install/mysql #导入rsyslog提供的数据库表配置root@ubuntu-test2:~# vim /etc/rsyslog.conf #修改rsyslog配置并采取服务
module(load="ommysql")
root@ubuntu-test2:~# vim /etc/rsyslog.d/50-default.conf
*.info :0mmysql:localhost:Syslog:rsyslog:Wlm@123
root@ubuntu-test2:~# systemctl restart rsyslog.service
#测试结果
[root@Rocky-test1 rsyslog.d]# logger "this is a test" #发送测试日志
root@ubuntu-test2:~# mysql -uroot -h'localhost' #登录数据库看是否有测试日志生成
mysql> select * from SystemEvents;
| 3382 | NULL | 2024-06-04 17:48:28 | 2024-06-04 17:48:26 | 1 | 5 | Rocky-test1 | this is a test | NULL | NULL | NULL | NULL | NULL | NULL | NULL | NULL | NULL | NULL | NULL | 1 | root[29479]: | NULL | NULL | NULL |
五、实现logrotate服务切割nginx日志
针对ubuntu-test2的auth.log日志进行转储,目标每天备份一次,保留90天,每个日志大小不超过3M
#安装配置logrotate
root@ubuntu-test2:~# apt update && apt -y install logrotate
root@ubuntu-test2:~# vim /etc/logrotate.d/rsyslog-test/var/log/auth.log #日志存储位置
{rotate 90 #转储备份数量
size 3M #转储文件上限
daily #转储周期为天
create 644 root root #创建转储文件权限和所属组missingok #如果日志不存在不提示错误,继续处理
notifempty #空文件不转储
compress #压缩转储文件
delaycompress #延迟压缩转储文件sharedscripts
}#测试
root@ubuntu-test2:~# dd if=/dev/zero of=/var/log/auth.log bs=1M count=3 #日志写满3M触发转储条件
3+0 records in
3+0 records out
3145728 bytes (3.1 MB, 3.0 MiB) copied, 0.0151487 s, 208 MB/s
root@ubuntu-test2:~# logrotate /etc/logrotate.d/rsyslog-test #手动触发转储root@ubuntu-test2:~# ls /var/log/auth*
/var/log/auth.log /var/log/auth.log.1
六、总结 LVS的NAT和DR模型工作原理,完成DR模型实战
6.1,工作原理
LVS的NAT工作原理:
LVS服务器将客户端产生的请求报文的IP和端口修改为LVS内部IP和端口,并在内部网络广播直到收到响应报文,将响应报文的IP和端口修改为LVS外部IP和端口发送回客户端
LVS的DR工作原理:
LVS服务器将客户端产生的请求报文的目标MAC修改为RS服务器的MAC,由于LVS和RS服务器的VIP为同一个,通过路由器传入内网的请求报文根据MAC寻找目标服务器,目标服务器的响应报文直接通过路由器寻找请求IP返回客户端
6.2,DR模型单网段
环境配置:
Rocky-test1--测试主机,仅主机(192.168.10.6)
ubuntu--LVS服务器,NAT网络(10.0.0.160)
ubuntu-test1--路由器,仅主机和NAT网络(192.168.10.200,10.0.0.161)
ubuntu-test2--RS_WEB服务器1,NAT网络(10.0.0.162)
ubuntu-test3--RS_WEB服务器2,NAT网络(10.0.0.163)
#RS服务器安装apache服务
root@ubuntu-test2:~# apt update && apt -y install apache2
root@ubuntu-test2:~# systemctl start apache2
root@ubuntu-test2:~# echo `hostname` > /var/www/html/index.html
root@ubuntu-test3:~# apt update && apt -y install apache2
root@ubuntu-test3:~# systemctl start apache2
root@ubuntu-test3:~# echo `hostname` > /var/www/html/index.html
#测试主机配置网络
[root@Rocky-test1 ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens160
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=static
IPADDR=192.168.10.6
NETMASK=255.255.255.0
GATEWAY=192.168.10.200
DNS1=223.5.5.5
DNS2=119.29.29.29
NAME=ens160
UUID=44653696-afaa-41eb-865b-55902c0ac25b
DEVICE=ens160
ONBOOT=yes
[root@Rocky-test1 ~]# nmcli connection reload[root@Rocky-test1 ~]# nmcli connection up ens160
#路由器网络配置
root@ubuntu-test:~# vim /etc/netplan/00-installer-config.yaml
network:
ethernets:
ens33:
dhcp4: no
addresses:
- 10.0.0.161/24
gateway4: 10.0.0.2
nameservers:
addresses: [8.8.8.8,223.5.5.5]
ens36:
dhcp4: no
addresses:
- 192.168.10.200/24
version: 2
root@ubuntu-test:~# netplan applyroot@ubuntu-test:~# vim /etc/sysctl.conf
net.ipv4.ip_forward = 1
root@ubuntu-test:~# echo "1" > /proc/sys/net/ipv4/ip_forward #路由器需要开启ip_forward才能保证响应报文回到测试端
#LVS服务器配置
root@ubuntu:~# apt update && apt -y install ipvsadm
root@ubuntu:~# ip addr add 10.0.0.200/32 dev lo:1 #配置VIP的lo网卡
root@ubuntu:~# vim /etc/netplan/00-installer-config.yaml
network:
ethernets:
ens33:
dhcp4: no
addresses:
- 10.0.0.160/24
gateway4: 10.0.0.161
nameservers:
addresses: [114.114.114.114, 8.8.8.8]
version: 2
root@ubuntu:~# netplan applyroot@ubuntu:~# echo "0" > /proc/sys/net/ipv4/conf/all/rp_filter #关闭路径
root@ubuntu:~# echo "0" > /proc/sys/net/ipv4/conf/ens33/rp_filter #反向校验
root@ubuntu:~# ipvsadm -A -t 10.0.0.200:80 -s rr #配置LVS策略
root@ubuntu:~# ipvsadm -a -t 10.0.0.200:80 -r 10.0.0.162:80 -g
root@ubuntu:~# ipvsadm -a -t 10.0.0.200:80 -r 10.0.0.163:80 -g
root@ubuntu:~# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 10.0.0.200:80 rr
-> 10.0.0.162:80 Route 1 0 0
-> 10.0.0.163:80 Route 1 0 0#RS1网络配置
root@ubuntu-test2:~# ip addr add 10.0.0.200/32 dev lo:1 #配置VIP的lo网卡
root@ubuntu-test2:~# echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore #限制arp
root@ubuntu-test2:~# echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce #响应和
root@ubuntu-test2:~# echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore #通告级别
root@ubuntu-test2:~# echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announceroot@ubuntu-test2:~# vim /etc/netplan/00-installer-config.yaml
# This is the network config written by 'subiquity'
network:
ethernets:
ens33:
dhcp4: no
addresses: [10.0.0.162/24]
gateway4: 10.0.0.161
nameservers:
addresses: [8.8.8.8,223.5.5.5]
version: 2
root@ubuntu-test2:~# netplan applyroot@ubuntu-test2:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet 10.0.0.200/32 scope global lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:f7:f6:cf brd ff:ff:ff:ff:ff:ff
inet 10.0.0.162/24 brd 10.0.0.255 scope global ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fef7:f6cf/64 scope link
valid_lft forever preferred_lft forever#RS2网络配置同上
root@ubuntu-test3:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet 10.0.0.200/32 scope global lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:9b:bd:35 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.163/24 brd 10.0.0.255 scope global ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe9b:bd35/64 scope link
valid_lft forever preferred_lft forever
#测试结果
[root@Rocky-test1 ~]# curl 10.0.0.200
ubuntu-test3
[root@Rocky-test1 ~]# curl 10.0.0.200
ubuntu-test2
[root@Rocky-test1 ~]# curl 10.0.0.200
ubuntu-test3#轮询成功证明DR配置无问题
6.3,DR模型双网段
环境配置同6.2DR模型单网段配置
#测试主机配置同单网段模型
#路由器在原配置基础上添加新网段
root@ubuntu-test:~# ip addr add 172.16.0.200/24 dev ens33
root@ubuntu-test:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:40:fa:70 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.161/24 brd 10.0.0.255 scope global ens33
valid_lft forever preferred_lft forever
inet 172.16.0.200/24 scope global ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe40:fa70/64 scope link
valid_lft forever preferred_lft forever
3: ens36: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:40:fa:7a brd ff:ff:ff:ff:ff:ff
inet 192.168.10.200/24 brd 192.168.10.255 scope global ens36
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe40:fa7a/64 scope link
valid_lft forever preferred_lft forever#LVS和RS服务器保持原有配置,仅需将VIP地址修改为新增网段即可
root@ubuntu:~# ip addr add 172.16.0.100/32 dev lo:1
root@ubuntu2:~# ip addr add 172.16.0.100/32 dev lo:1
root@ubuntu3:~# ip addr add 172.16.0.100/32 dev lo:1
root@ubuntu:~# ipvsadm -A -t 172.16.0.100:80 -s rr
root@ubuntu:~# ipvsadm -a -t 172.16.0.100:80 -r 10.0.0.163:80 -g
root@ubuntu:~# ipvsadm -a -t 172.16.0.100:80 -r 10.0.0.162:80 -g
root@ubuntu:~# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 172.16.0.100:80 rr
-> 10.0.0.162:80 Route 1 0 0
-> 10.0.0.163:80 Route 1 0 0#测试主机访问VIP
[root@Rocky-test1 ~]# curl 172.16.0.100
ubuntu-test2
[root@Rocky-test1 ~]# curl 172.16.0.100
ubuntu-test3
[root@Rocky-test1 ~]# curl 172.16.0.100
ubuntu-test2#轮询成功证明DR配置无问题