Setting up and managing logs?
Posted by summitwulf on Tue 28 Feb 2006 at 10:16
What good advice do you have for setting up and managing logging on a Debian box? I come from a Red Hat 9.0 environment, where there was a rather convenient integrated GUI that let you browse the various logfiles - very useful to see all the failed logins to your SSH account as people tried to break in, for example.
Is there something similar for managing all the logfiles generated by your programs in Debian? How about if you have a text-only environment?
Descriptions of your current logging setup would be great - along with things to definitely do, and to absolutely avoid... =)
[ Parent | Reply to this comment ]
apt-get install logcheckIt's a script that will parse your logs and mail all the interesting bits for you to look at. It is also easy to customize. Cheers! -Mattias
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
I admit I prefer 'logwatch'.
[ Parent | Reply to this comment ]
Through correctness comes ease
-Chiun
-The Destroyer series
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
One daily mail is easier to digest than several arriving at different times.
[ Parent | Reply to this comment ]
curious
can you have logwatch scan multiple times a day? the man2html is broken on the logwatch.org site.
aaron
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
Sure you can.
By default a file is placed at /etc/cron.daily/00logwatch to make it run once a day.
I suspect that you'd get the earlier entries from a previous run duplicated though.
[ Parent | Reply to this comment ]
I have never seen it as a problem that the reports can arrive at any time during the day. As logcheck reports only anomalies in the logs I can be reasonably certain that everything is OK if I have no reports waiting in my INBOX.
Another good reason for using logcheck is that many Debian packages come with pre-configured conf-files for logcheck (so that it knows what not to report as an error).
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
Unless your mailer is broken and you just don't get mails sent ;)
Sure everything you say is valid, but for me with a whole load of internal only machines which are setup in a fairly secure manner running minimal external services and few local users it is better to have only a few mails to scan.
[ Parent | Reply to this comment ]
Most of the times, it runs and founds nothing interesting (i.e.: all messages are known to logcheck and "normal" for the system). But when I have a problem, I get on it ASAP.
Surely there has a problem. When you're out for some days you'll end up with zillions of emails. ;)
But if you have a decent number of monitored servers you'll probably be in a company with more than one IT admin, so the logs could be (should be) redirected to a common account, so at any time there's someone watching at them.
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
I have to admit though, I haven't set up Nagios to alert me for immediate security warnings. I know that's possible though, I'll just read on it when I have time I guess.
[ Parent | Reply to this comment ]
You are off the edge of the map, mate. Here there be monsters!
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
This is definitely something to be aware of in high-risk environments, yes.
But I think that Logwatch will highlight unknown entries in at least /var/log/messages.
I'm happy enough with logwatch for my low-risk machines.
[ Parent | Reply to this comment ]
You are off the edge of the map, mate. Here there be monsters!
[ Parent | Reply to this comment ]
Now I just need to find out how to configure exim4 to mail me log reports... that should probably be a separate question.
[ Parent | Reply to this comment ]
a very useful link:
http://gentoo-wiki.com/HOWTO_setup_PHP-Syslog-NG
Apart from the beautiful interface, using a db gives you loads of flexibility. In fact you can decide whay you want to see. If not afraid of scripting, then this is the way to go.
[ Parent | Reply to this comment ]
#put EVERYTHING on 12th console, very nifty to press alt-F12 and see all that happens
*.* /dev/tty12
#put EVERYTHING except postfix log to one log file, so you only have to check one
*.*;local0.none /var/log/system.log
# postfix logs here
local0.* /var/log/postfix.log
# Emergencies are sent to everybody logged in.
*.emerg *
---
it think the default setup to log in 1233 gazillion files is quite unwieldy.
[ Parent | Reply to this comment ]
syslog_facility = local0
[ Parent | Reply to this comment ]
To have nice, colorized logs on 12th console install ccze package and put something like this to /etc/inittab:
C:12345:wait:/usr/bin/tail -n30 -f /var/log/messages | /usr/bin/ccze > /dev/tty12
Also, set up your logging system to send all logs to /var/log/messages. Then kill -HUP 1 to make init reread inittab.
Best Regards,
Luke
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
sshd:
Authentication Failures:
sno (127.0.0.1): 1 Time(s)
Sessions Opened:
sno: 3 Time(s)
user: 1 Time(s)
[ Parent | Reply to this comment ]