第八周作业-Linux日志管理

一、日志分类和优先级总结

1.1，日志分类

日志类型	作用	存放位置
系统日志	记录系统运行中的事件	/var/log/syslog(messages)
认证日志	记录用户认证信息	/var/log/auth.log(secure)
程序日志	记录应用程序的日志信息	/var/log/程序名
用户日志	记录用户级别的事件	/var/log/userlog(wtmp)
启动日志	记录系统启动和关闭过程中的日志	/var/log/boot.log(boot)

1.2，日志优先级

从 低 到 高	debug	记录详细的调试信息
	info	记录程序运行的一般信息
	notice	记录程序正常运行但是重要的信息
	warn	记录可能会影响程序正常运行但不会导致程序停止的信息
	err	记录程序运行中的错误信息
	crit	记录临界条件信息
	alert	记录必须立即执行的行动
	emerg	记录程序运行中的严重错误

二、实例：SSH日志的rsyslog应用

2.1，实例1-ssh日志通过rsyslog写入特定文件

[root@Rocky-test1 ~]# vim /etc/ssh/sshd_config              #配置sshd服务日志类别

SyslogFacility local6
[root@Rocky-test1 ~]# systemctl restart sshd 

[root@Rocky-test1 ~]# touch /var/log/ssh.log 

[root@Rocky-test1 ~]# vim /etc/rsyslog.conf     #local6的info级别以上信息写入指定文件    
local6.info                                               /var/log/ssh.log

[root@Rocky-test1 ~]# systemctl restart syslog.service    #重启服务生效

2.2，实例2-多台服务器ssh日志集中写入单一文件

将Rocky-test1，ubuntu-test1和ubuntu-test2的ssh日志写入ubuntu-test2服务器内

#Rocky-test1配置

[root@Rocky-test1 ~]# vim /etc/ssh/sshd_config

SyslogFacility AUTH

[root@Rocky-test1 ~]# vim /etc/rsyslog.conf                          #开启udp

module(load="imudp") # needs to be done just once
input(type="imudp" port="514")

auth.info                                             @10.0.0.162

[root@Rocky-test1 ~]# systemctl restart sshd

[root@Rocky-test1 ~]# systemctl restart rsyslog.service
 

#ubuntu-test1配置

root@ubuntu-test1:~# vim /etc/ssh/sshd_config

SyslogFacility AUTH

root@ubuntu-test1:~# systemctl restart sshd

root@ubuntu-test1:~# vim /etc/rsyslog.conf

module(load="imudp")
input(type="imudp" port="514")
auth.info                        @10.0.0.162:514
root@ubuntu-test1:~# systemctl restart rsyslog.service

#ubuntu-test2配置

root@ubuntu-test2:/var/log# vim /etc/rsyslog.conf

module(load="imudp")
input(type="imudp" port="514")
root@ubuntu-test2:/var/log# systemctl restart rsyslog.service

#Rocky-test1，ubuntu-test1退出重新登录

root@ubuntu-test2:/var/log# tail -f /var/log/auth.log
Jun  4 10:17:47 Rocky-test1 systemd-logind[994]: Session 12 logged out. Waiting for processes to exit.
Jun  4 10:17:47 Rocky-test1 systemd-logind[994]: Removed session 12.
Jun  4 10:17:47 Rocky-test1 systemd-logind[994]: Session 13 logged out. Waiting for processes to exit.
Jun  4 10:17:47 Rocky-test1 systemd-logind[994]: Removed session 13.
Jun  4 10:17:51 Rocky-test1 sshd[26614]: Accepted password for root from 10.0.0.1 port 57706 ssh2
Jun  4 10:17:51 Rocky-test1 systemd-logind[994]: New session 14 of user root.
Jun  4 10:17:51 Rocky-test1 sshd[26616]: Accepted password for root from 10.0.0.1 port 57707 ssh2
Jun  4 10:17:51 Rocky-test1 systemd-logind[994]: New session 15 of user root.
Jun  4 10:30:25 ubuntu-test1 systemd-logind[810]: Session 19 logged out. Waiting for processes to exit.
Jun  4 10:30:25 ubuntu-test1 systemd-logind[810]: Removed session 19.
Jun  4 10:30:25 ubuntu-test1 systemd-logind[810]: Session 20 logged out. Waiting for processes to exit.
Jun  4 10:30:25 ubuntu-test1 systemd-logind[810]: Removed session 20.
Jun  4 10:30:29 ubuntu-test1 systemd-logind[810]: New session 42 of user root.
Jun  4 10:30:30 ubuntu-test1 systemd-logind[810]: New session 43 of user root.

三、总结journalctl命令

journalctl 

-a                #完整显示字段内容

-f                 #只显示最新的日志项，且不断显示新生成的日志

-n   --line      #限制显示最新的日志行数，默认为10

-r                 #反转日志行的输出顺序

-o                #控制日志输出格式

-b   --boot    #显示特定于某次启动的日志

-k                #仅显示内核日志

-S                #显示晚于指定时间的日志

-U                #显示早于指定时间的日志

-u   --user-unit    #仅显示属于特定用户会话单元的日志

-p   --priority      #根据日志优先级过滤输出结果

[root@Rocky-test1 ~]# journalctl -b -0
-- Logs begin at Mon 2024-06-03 11:18:35 CST, end at Mon 2024-06-03 11:21:17 CST. --
Jun 03 11:18:35 Rocky-test1 kernel: Linux version 4.18.0-372.9.1.el8.x86_64 (mockbuild@dal1-prod-builder001.bld.equ.roc>
Jun 03 11:18:35 Rocky-test1 kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-372.9.1.el8.x86_64 root=/dev/m>

[root@Rocky-test1 ~]# journalctl -f
-- Logs begin at Mon 2024-06-03 11:18:35 CST. --
Jun 03 14:12:35 Rocky-test1 systemd[1]: dnf-makecache.service: Succeeded.
Jun 03 14:12:35 Rocky-test1 systemd[1]: Started dnf makecache.
[root@Rocky-test1 ~]# journalctl -k
-- Logs begin at Mon 2024-06-03 11:18:35 CST, end at Mon 2024-06-03 14:12:35 CST. --
Jun 03 11:18:35 Rocky-test1 kernel: Linux version 4.18.0-372.9.1.el8.x86_64 (mockbuild@dal1-prod-builder001.bld.equ.roc>
Jun 03 11:18:35 Rocky-test1 kernel: Command line: BOOT_IMAGE=(hd0,msdos1)/vmlinuz-4.18.0-372.9.1.el8.x86_64 root=/dev/m>
Jun 03 11:18:35 Rocky-test1 kernel: Disabled fast string operations
Jun 03 11:18:35 Rocky-test1 kernel: x86/fpu: x87 FPU will use FXSAVE
Jun 03 11:18:35 Rocky-test1 kernel: signal: max sigframe size: 1440
Jun 03 11:18:35 Rocky-test1 kernel: BIOS-provided physical RAM map:
[root@Rocky-test1 ~]# journalctl -S "2024-06-03 13:00:00"
-- Logs begin at Mon 2024-06-03 11:18:35 CST, end at Mon 2024-06-03 15:01:01 CST. --
Jun 03 13:01:02 Rocky-test1 CROND[1621]: (root) CMD (run-parts /etc/cron.hourly)
Jun 03 13:01:02 Rocky-test1 run-parts[1624]: (/etc/cron.hourly) starting 0anacron
Jun 03 13:01:02 Rocky-test1 run-parts[1630]: (/etc/cron.hourly) finished 0anacron
Jun 03 14:01:01 Rocky-test1 CROND[1639]: (root) CMD (run-parts /etc/cron.hourly)
Jun 03 14:01:01 Rocky-test1 run-parts[1642]: (/etc/cron.hourly) starting 0anacron
Jun 03 14:01:01 Rocky-test1 run-parts[1648]: (/etc/cron.hourly) finished 0anacron
Jun 03 14:12:35 Rocky-test1 systemd[1]: Starting dnf makecache...
Jun 03 14:12:35 Rocky-test1 dnf[1649]: Metadata cache refreshed recently.
Jun 03 14:12:35 Rocky-test1 systemd[1]: dnf-makecache.service: Succeeded.
Jun 03 14:12:35 Rocky-test1 systemd[1]: Started dnf makecache.
Jun 03 15:01:01 Rocky-test1 CROND[1669]: (root) CMD (run-parts /etc/cron.hourly)
Jun 03 15:01:01 Rocky-test1 run-parts[1672]: (/etc/cron.hourly) starting 0anacron
Jun 03 15:01:01 Rocky-test1 run-parts[1678]: (/etc/cron.hourly) finished 0anacron

四、实现多主机日志收集

将Rocky-test1，ubuntu-test1和ubuntu-test2的日志写入ubuntu-test2服务器内的数据库内

#在ubuntu-test2安装数据库和相关的rsyslog服务组件

root@ubuntu-test2:~# apt install -y mysql-server
root@ubuntu-test2:~# vim /etc/mysql/mysql.conf.d/mysqld.cnf        

#bind-address           = 127.0.0.1                                #Ubuntu需要注释掉这两行内容才能
#mysqlx-bind-address    = 127.0.0.1                           #远程连接数据库

root@ubuntu-test2:~# systemctl restart mysql.service

root@ubuntu-test2:~# mysql

mysql> alter user root@'localhost' identified by 'Wlm@123';
Query OK, 0 rows affected (0.02 sec)
root@ubuntu-test2:~# apt update && apt -y install rsyslog-mysql

root@ubuntu-test2:~# cat /etc/rsyslog.d/mysql.conf     #查看并配置rsyslog-mysql配置
### Configuration file for rsyslog-mysql
### Changes are preserved

module (load="ommysql")
*.* action(type="ommysql" server="localhost" db="Syslog" uid="rsyslog" pwd="Wlm@123")

root@ubuntu-test2:~# mysql -uroot -h'localhost'                #为rsyslog配置数据库

mysql> create user rsyslog@'localhost' identified by 'Wlm@123';
Query OK, 0 rows affected (0.15 sec)

mysql> create database Syslog;
Query OK, 1 row affected (0.02 sec)

mysql> grant all on Syslog.* to rsyslog@'localhost';
Query OK, 0 rows affected (0.00 sec)
root@ubuntu-test2:~# mysql -uroot -h'localhost' -b Syslog < /usr/share/dbconfig-common/data/rsyslog-mysql/install/mysql                #导入rsyslog提供的数据库表配置

root@ubuntu-test2:~# vim /etc/rsyslog.conf                #修改rsyslog配置并采取服务

module(load="ommysql")

root@ubuntu-test2:~# vim /etc/rsyslog.d/50-default.conf

*.info                          :0mmysql:localhost:Syslog:rsyslog:Wlm@123

root@ubuntu-test2:~# systemctl restart rsyslog.service

#测试结果

[root@Rocky-test1 rsyslog.d]# logger "this is a test"   #发送测试日志

root@ubuntu-test2:~# mysql -uroot -h'localhost'         #登录数据库看是否有测试日志生成

mysql> select * from SystemEvents;

| 3382 |       NULL | 2024-06-04 17:48:28 | 2024-06-04 17:48:26 |        1 |        5 | Rocky-test1  |  this is a test                                                                                                                                                                                                   |       NULL |       NULL | NULL        | NULL      |          NULL |    NULL | NULL            |         NULL |      NULL |     NULL |     NULL |          1 | root[29479]:           | NULL         | NULL            |     NULL |

五、实现logrotate服务切割nginx日志

针对ubuntu-test2的auth.log日志进行转储，目标每天备份一次，保留90天，每个日志大小不超过3M

#安装配置logrotate

root@ubuntu-test2:~# apt update && apt -y install logrotate
root@ubuntu-test2:~# vim /etc/logrotate.d/rsyslog-test

/var/log/auth.log                                #日志存储位置
{

        rotate 90                                   #转储备份数量
        size 3M                                     #转储文件上限
        daily                                          #转储周期为天
        create 644 root root                  #创建转储文件权限和所属组

        missingok                                  #如果日志不存在不提示错误，继续处理
        notifempty                                 #空文件不转储
        compress                                  #压缩转储文件
        delaycompress                          #延迟压缩转储文件

        sharedscripts
}

#测试

root@ubuntu-test2:~# dd if=/dev/zero of=/var/log/auth.log bs=1M count=3        #日志写满3M触发转储条件
3+0 records in
3+0 records out
3145728 bytes (3.1 MB, 3.0 MiB) copied, 0.0151487 s, 208 MB/s
root@ubuntu-test2:~# logrotate /etc/logrotate.d/rsyslog-test                   #手动触发转储

root@ubuntu-test2:~# ls /var/log/auth*
/var/log/auth.log  /var/log/auth.log.1

六、总结 LVS的NAT和DR模型工作原理，完成DR模型实战

6.1，工作原理

LVS的NAT工作原理：

        LVS服务器将客户端产生的请求报文的IP和端口修改为LVS内部IP和端口，并在内部网络广播直到收到响应报文，将响应报文的IP和端口修改为LVS外部IP和端口发送回客户端

LVS的DR工作原理：

        LVS服务器将客户端产生的请求报文的目标MAC修改为RS服务器的MAC，由于LVS和RS服务器的VIP为同一个，通过路由器传入内网的请求报文根据MAC寻找目标服务器，目标服务器的响应报文直接通过路由器寻找请求IP返回客户端

6.2，DR模型单网段

环境配置：

Rocky-test1--测试主机,仅主机（192.168.10.6）

ubuntu--LVS服务器，NAT网络（10.0.0.160）

ubuntu-test1--路由器，仅主机和NAT网络（192.168.10.200，10.0.0.161）

ubuntu-test2--RS_WEB服务器1，NAT网络（10.0.0.162）

ubuntu-test3--RS_WEB服务器2，NAT网络（10.0.0.163）

#RS服务器安装apache服务

root@ubuntu-test2:~# apt update && apt -y install apache2

root@ubuntu-test2:~# systemctl start apache2

root@ubuntu-test2:~# echo `hostname` > /var/www/html/index.html

root@ubuntu-test3:~# apt update && apt -y install apache2

root@ubuntu-test3:~# systemctl start apache2

root@ubuntu-test3:~# echo `hostname` > /var/www/html/index.html

#测试主机配置网络

[root@Rocky-test1 ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens160
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=static
IPADDR=192.168.10.6
NETMASK=255.255.255.0
GATEWAY=192.168.10.200
DNS1=223.5.5.5
DNS2=119.29.29.29
NAME=ens160
UUID=44653696-afaa-41eb-865b-55902c0ac25b
DEVICE=ens160
ONBOOT=yes
[root@Rocky-test1 ~]# nmcli connection reload

[root@Rocky-test1 ~]# nmcli connection up ens160

#路由器网络配置

root@ubuntu-test:~# vim /etc/netplan/00-installer-config.yaml

network:
  ethernets:
    ens33:
      dhcp4: no
      addresses:
        - 10.0.0.161/24
      gateway4: 10.0.0.2
      nameservers:
        addresses: [8.8.8.8,223.5.5.5]
    ens36:
      dhcp4: no
      addresses:
        - 192.168.10.200/24
  version: 2
root@ubuntu-test:~# netplan apply

root@ubuntu-test:~# vim /etc/sysctl.conf

net.ipv4.ip_forward = 1

root@ubuntu-test:~# echo "1" > /proc/sys/net/ipv4/ip_forward        #路由器需要开启ip_forward才能保证响应报文回到测试端

#LVS服务器配置

root@ubuntu:~# apt update && apt -y install ipvsadm       

root@ubuntu:~# ip addr add 10.0.0.200/32 dev lo:1                               #配置VIP的lo网卡

root@ubuntu:~# vim /etc/netplan/00-installer-config.yaml

network:
  ethernets:
    ens33:
      dhcp4: no
      addresses:
        - 10.0.0.160/24
      gateway4: 10.0.0.161
      nameservers:
        addresses: [114.114.114.114, 8.8.8.8]
  version: 2
root@ubuntu:~# netplan apply

root@ubuntu:~# echo "0" > /proc/sys/net/ipv4/conf/all/rp_filter                        #关闭路径

root@ubuntu:~# echo "0" > /proc/sys/net/ipv4/conf/ens33/rp_filter                  #反向校验

root@ubuntu:~# ipvsadm -A -t 10.0.0.200:80 -s rr                                         #配置LVS策略
root@ubuntu:~# ipvsadm -a -t 10.0.0.200:80 -r 10.0.0.162:80 -g
root@ubuntu:~# ipvsadm -a -t 10.0.0.200:80 -r 10.0.0.163:80 -g
root@ubuntu:~# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  10.0.0.200:80 rr
  -> 10.0.0.162:80                Route   1      0          0
  -> 10.0.0.163:80                Route   1      0          0

#RS1网络配置

root@ubuntu-test2:~# ip addr add 10.0.0.200/32 dev lo:1                     #配置VIP的lo网卡

root@ubuntu-test2:~# echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore             #限制arp

root@ubuntu-test2:~# echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce       #响应和
root@ubuntu-test2:~# echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore              #通告级别
root@ubuntu-test2:~# echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce

root@ubuntu-test2:~# vim /etc/netplan/00-installer-config.yaml

# This is the network config written by 'subiquity'
network:
  ethernets:
    ens33:
      dhcp4: no
      addresses: [10.0.0.162/24]
      gateway4: 10.0.0.161
      nameservers:
        addresses: [8.8.8.8,223.5.5.5]
  version: 2
root@ubuntu-test2:~# netplan apply

root@ubuntu-test2:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 10.0.0.200/32 scope global lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:f7:f6:cf brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.162/24 brd 10.0.0.255 scope global ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fef7:f6cf/64 scope link
       valid_lft forever preferred_lft forever

#RS2网络配置同上

root@ubuntu-test3:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 10.0.0.200/32 scope global lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:9b:bd:35 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.163/24 brd 10.0.0.255 scope global ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe9b:bd35/64 scope link
       valid_lft forever preferred_lft forever
 

#测试结果

[root@Rocky-test1 ~]# curl 10.0.0.200
ubuntu-test3
[root@Rocky-test1 ~]# curl 10.0.0.200
ubuntu-test2
[root@Rocky-test1 ~]# curl 10.0.0.200
ubuntu-test3

#轮询成功证明DR配置无问题

6.3，DR模型双网段

环境配置同6.2DR模型单网段配置

#测试主机配置同单网段模型

#路由器在原配置基础上添加新网段

root@ubuntu-test:~# ip addr add 172.16.0.200/24 dev ens33
root@ubuntu-test:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:40:fa:70 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.161/24 brd 10.0.0.255 scope global ens33
       valid_lft forever preferred_lft forever
    inet 172.16.0.200/24 scope global ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe40:fa70/64 scope link
       valid_lft forever preferred_lft forever
3: ens36: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:40:fa:7a brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.200/24 brd 192.168.10.255 scope global ens36
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe40:fa7a/64 scope link
       valid_lft forever preferred_lft forever

#LVS和RS服务器保持原有配置，仅需将VIP地址修改为新增网段即可

root@ubuntu:~# ip addr add 172.16.0.100/32 dev lo:1

root@ubuntu2:~# ip addr add 172.16.0.100/32 dev lo:1

root@ubuntu3:~# ip addr add 172.16.0.100/32 dev lo:1

root@ubuntu:~# ipvsadm -A -t 172.16.0.100:80 -s rr
root@ubuntu:~# ipvsadm -a -t 172.16.0.100:80 -r 10.0.0.163:80 -g
root@ubuntu:~# ipvsadm -a -t 172.16.0.100:80 -r 10.0.0.162:80 -g
root@ubuntu:~# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  172.16.0.100:80 rr
  -> 10.0.0.162:80                Route   1      0          0
  -> 10.0.0.163:80                Route   1      0          0

#测试主机访问VIP

[root@Rocky-test1 ~]# curl 172.16.0.100
ubuntu-test2
[root@Rocky-test1 ~]# curl 172.16.0.100
ubuntu-test3
[root@Rocky-test1 ~]# curl 172.16.0.100
ubuntu-test2

#轮询成功证明DR配置无问题