Linux Log Management
Tags: linux, bash, logs
Published: 2023-02-10 06:00:18

## Introduction

There are two types of log in Linux systems

- Normal Text logs
- Binary logs

There are several different commands to analyze these logs

👉 `vi`, `cat`, `tail`, `head`, etc. are used for normal logs

👉 `last`, `w`, `who`, etc. are used for binary logs

## Analyzing important Linux Log

There are different log files found under `/var/log/` directory. The following are some of them:

- **UTMP** 👉 contains info about the current state of the system
```bash
who
root     pts/0        2023-02-10 10:16 (192.168.1.1)
```
---
- **WTMP** 👉 updated each time a user logs in or out or even when a terminal line is opened or closed
```bash
last root
root     pts/0        192.168.1.1      Fri Feb 10 10:16   still logged in   
root     pts/0        192.168.1.1      Thu Feb  9 12:50 - crash  (21:24)    
```
---
- **BTMP** 👉 similar to `wtmp` however it just keeps a record of past logins and logouts
```bash
lastb
root     tty1                          Thu Feb  9 11:58 - 11:58  (00:00)    

btmp begins Thu Feb  9 11:58:13 2023
```
---
- **Secure** 👉 stores information about security-related events (such as authentication attempts, SSH login attempts)
```bash
tail -5 /var/log/secure
Feb 10 12:02:29 Linux-1 polkitd[652]: Unregistered Authentication 
```
---
- **Last** 👉 keeps track of all system reboots and shutdowns (stored inside `/var/log/wtmp` file)
```bash
-t 5
사용자이름       포트     어디서           최근정보
root             pts/0    192.168.1.1      금  2월 10 10:16:38 +0900 2023
```
---
- **Messages** 👉 stores a wide variety of system-related messages
```bash
tail /var/log/messages
Feb 10 13:12:30 Linux-1 dhcpd: DHCPREQUEST for 192.168.1.52 from 00:0c:29:b1:be:84 (Linux-2) via ens32
Feb 10 13:12:30 Linux-1 dhcpd: DHCPACK on 192.168.1.52 to 00:0c:29:b1:be:84 (Linux-2) via ens32
```
---

## psacct Tool

We can also use the `psacct` package. The package provides a set of tools and services for logging information about processes that run on the system.

Installing the package using `yum`
```bash
yum -y install psacct
```

Starting the package daemon
```bash
systemctl start psacct
```

Now if we use the `ac` command,
```bash
ac -d root
Jan 10	total        2.73
Jan 26	total        2.02
Jan 31	total        1.14
Feb  2	total        5.74
```
*👉 The ac -d root command is used to display the accumulated accounting information for the root user.*

We can also use the `lastcomm` command,
```bash
lastcomm ls
ls                     root     pts/0      0.00 secs Fri Feb 10 13:52

lastcomm root
kworker/0:1       F    root     __         0.17 secs Fri Feb 10 13:49
lastcomm               root     pts/0      0.00 secs Fri Feb 10 14:03
clear                  root     pts/0      0.00 secs Fri Feb 10 14:02
```
*👉 This command displays information about previously executed commands on the system.*

---

## logrotate Tool

Another tool we have in hand is `logrotate`. The purpose of logrotate is to rotate, compress, and remove old log files, so that they do not consume excessive disk space. 

### How it works

1. The `logrotate` configuration file specifies the log files to be managed and the policies for how those files should be rotated, compressed, and removed.

2. When `logrotate` runs, it checks each log file specified in the configuration file to determine if it needs to be rotated. The decision to rotate a log file is based on the size of the file and the time it was last rotated.

3. If a log file needs to be rotated, `logrotate` will create a new log file and rename the existing log file by appending a date/time stamp to the file name. The renamed log file will be compressed (if configured to do so) and saved to disk.

4. After rotating and compressing the log files, `logrotate` will remove any log files that are older than the specified number of days (if specified in the configuration file).