| 知乎專欄 ｜ 多維度架構 | 微信號 netkiller-ebook | QQ群：128659835 請註明“讀者” |
目錄
過程 5.1. logwatch 安裝步驟:
Install
Ubuntu 7.10
netkiller@shenzhen:/etc/webmin$ apt-cache search logwatch fwlogwatch - Firewall log analyzer logwatch - log analyser with nice output written in Perl
apt-get install
# apt-get install logwatch
the logwatch has been installed, it should create a file in '/etc/cron.daily/00logwatch'.
config
$ sudo cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/logwatch.conf $ sudo mkdir /var/cache/logwatch $ sudo vim /etc/logwatch/conf/logwatch.conf
mail to
# Default person to mail reports to. Can be a local account or a # complete email address. MailTo = root, openunix@163.com, other@example.com
To change detail level for the report
# The default detail level for the report. # This can either be Low, Med, High or a number. # Low = 0 # Med = 5 # High = 10 Detail = High
Crontab
netkiller@shenzhen:~$ cat /etc/cron.daily/00logwatch #!/bin/bash #Check if removed-but-not-purged test -x /usr/share/logwatch/scripts/logwatch.pl || exit 0 #execute /usr/sbin/logwatch
The logwatch is command, you can run it.
logwatch --print
單獨查看某個服務，比如 SSH 登錄信息
logwatch --service sshd --print
# yum search logcheck | grep logcheck Repodata is over 2 weeks old. Install yum-cron? Or run: yum makecache fast ============================ N/S matched: logcheck ============================= logcheck.noarch : Analyzes log files and sends noticeable events as email
安裝 logcheck
# yum install -y logcheck
查看 logchek 包所含檔案
[root@173 ~]# rpm -ql logcheck /etc/cron.d/logcheck /etc/logcheck /etc/logcheck/cracking.d /etc/logcheck/cracking.d/kernel /etc/logcheck/cracking.d/rlogind /etc/logcheck/cracking.d/rsh /etc/logcheck/cracking.d/smartd /etc/logcheck/cracking.d/tftpd /etc/logcheck/cracking.d/uucico /etc/logcheck/ignore.d.paranoid /etc/logcheck/ignore.d.paranoid/bind /etc/logcheck/ignore.d.paranoid/cron /etc/logcheck/ignore.d.paranoid/incron /etc/logcheck/ignore.d.paranoid/logcheck /etc/logcheck/ignore.d.paranoid/postfix /etc/logcheck/ignore.d.paranoid/ppp /etc/logcheck/ignore.d.paranoid/pureftp /etc/logcheck/ignore.d.paranoid/qpopper /etc/logcheck/ignore.d.paranoid/squid /etc/logcheck/ignore.d.paranoid/ssh /etc/logcheck/ignore.d.paranoid/stunnel /etc/logcheck/ignore.d.paranoid/sysklogd /etc/logcheck/ignore.d.paranoid/telnetd /etc/logcheck/ignore.d.paranoid/tripwire /etc/logcheck/ignore.d.paranoid/usb /etc/logcheck/ignore.d.server /etc/logcheck/ignore.d.server/NetworkManager /etc/logcheck/ignore.d.server/acpid /etc/logcheck/ignore.d.server/amandad /etc/logcheck/ignore.d.server/amavisd-new /etc/logcheck/ignore.d.server/anacron /etc/logcheck/ignore.d.server/anon-proxy /etc/logcheck/ignore.d.server/apache /etc/logcheck/ignore.d.server/apcupsd /etc/logcheck/ignore.d.server/arpwatch /etc/logcheck/ignore.d.server/asterisk /etc/logcheck/ignore.d.server/automount /etc/logcheck/ignore.d.server/bind /etc/logcheck/ignore.d.server/bluez-utils /etc/logcheck/ignore.d.server/courier /etc/logcheck/ignore.d.server/cpqarrayd /etc/logcheck/ignore.d.server/cpufreqd /etc/logcheck/ignore.d.server/cron /etc/logcheck/ignore.d.server/cron-apt /etc/logcheck/ignore.d.server/cups-lpd /etc/logcheck/ignore.d.server/cvs-pserver /etc/logcheck/ignore.d.server/cvsd /etc/logcheck/ignore.d.server/cyrus /etc/logcheck/ignore.d.server/dbus /etc/logcheck/ignore.d.server/dcc /etc/logcheck/ignore.d.server/ddclient /etc/logcheck/ignore.d.server/dhclient /etc/logcheck/ignore.d.server/dhcp /etc/logcheck/ignore.d.server/dictd /etc/logcheck/ignore.d.server/dkfilter /etc/logcheck/ignore.d.server/dkim-filter /etc/logcheck/ignore.d.server/dnsmasq /etc/logcheck/ignore.d.server/dovecot /etc/logcheck/ignore.d.server/dropbear /etc/logcheck/ignore.d.server/dspam /etc/logcheck/ignore.d.server/epmd /etc/logcheck/ignore.d.server/exim4 /etc/logcheck/ignore.d.server/fcron /etc/logcheck/ignore.d.server/ftpd /etc/logcheck/ignore.d.server/git-daemon /etc/logcheck/ignore.d.server/gnu-imap4d /etc/logcheck/ignore.d.server/gps /etc/logcheck/ignore.d.server/grinch /etc/logcheck/ignore.d.server/horde3 /etc/logcheck/ignore.d.server/hplip /etc/logcheck/ignore.d.server/hylafax /etc/logcheck/ignore.d.server/ikiwiki /etc/logcheck/ignore.d.server/imap /etc/logcheck/ignore.d.server/imapproxy /etc/logcheck/ignore.d.server/imp /etc/logcheck/ignore.d.server/imp4 /etc/logcheck/ignore.d.server/innd /etc/logcheck/ignore.d.server/ipppd /etc/logcheck/ignore.d.server/isdnlog /etc/logcheck/ignore.d.server/isdnutils /etc/logcheck/ignore.d.server/jabberd /etc/logcheck/ignore.d.server/kernel /etc/logcheck/ignore.d.server/klogind /etc/logcheck/ignore.d.server/krb5-kdc /etc/logcheck/ignore.d.server/libpam-krb5 /etc/logcheck/ignore.d.server/libpam-mount /etc/logcheck/ignore.d.server/logcheck /etc/logcheck/ignore.d.server/login /etc/logcheck/ignore.d.server/maradns /etc/logcheck/ignore.d.server/mldonkey-server /etc/logcheck/ignore.d.server/mon /etc/logcheck/ignore.d.server/mountd /etc/logcheck/ignore.d.server/nagios /etc/logcheck/ignore.d.server/netconsole /etc/logcheck/ignore.d.server/nfs /etc/logcheck/ignore.d.server/nntpcache /etc/logcheck/ignore.d.server/nscd /etc/logcheck/ignore.d.server/nslcd /etc/logcheck/ignore.d.server/openvpn /etc/logcheck/ignore.d.server/otrs /etc/logcheck/ignore.d.server/passwd /etc/logcheck/ignore.d.server/pdns /etc/logcheck/ignore.d.server/perdition /etc/logcheck/ignore.d.server/policyd /etc/logcheck/ignore.d.server/popa3d /etc/logcheck/ignore.d.server/postfix /etc/logcheck/ignore.d.server/postfix-policyd /etc/logcheck/ignore.d.server/ppp /etc/logcheck/ignore.d.server/pptpd /etc/logcheck/ignore.d.server/procmail /etc/logcheck/ignore.d.server/proftpd /etc/logcheck/ignore.d.server/puppetd /etc/logcheck/ignore.d.server/pure-ftpd /etc/logcheck/ignore.d.server/pureftp /etc/logcheck/ignore.d.server/qpopper /etc/logcheck/ignore.d.server/rbldnsd /etc/logcheck/ignore.d.server/rpc_statd /etc/logcheck/ignore.d.server/rsnapshot /etc/logcheck/ignore.d.server/rsync /etc/logcheck/ignore.d.server/sa-exim /etc/logcheck/ignore.d.server/samba /etc/logcheck/ignore.d.server/saned /etc/logcheck/ignore.d.server/sasl2-bin /etc/logcheck/ignore.d.server/saslauthd /etc/logcheck/ignore.d.server/schroot /etc/logcheck/ignore.d.server/scponly /etc/logcheck/ignore.d.server/slapd /etc/logcheck/ignore.d.server/smartd /etc/logcheck/ignore.d.server/smbd_audit /etc/logcheck/ignore.d.server/smokeping /etc/logcheck/ignore.d.server/snmpd /etc/logcheck/ignore.d.server/snort /etc/logcheck/ignore.d.server/spamc /etc/logcheck/ignore.d.server/spamd /etc/logcheck/ignore.d.server/squid /etc/logcheck/ignore.d.server/ssh /etc/logcheck/ignore.d.server/stunnel /etc/logcheck/ignore.d.server/su /etc/logcheck/ignore.d.server/sudo /etc/logcheck/ignore.d.server/sympa /etc/logcheck/ignore.d.server/syslogd /etc/logcheck/ignore.d.server/systemd /etc/logcheck/ignore.d.server/teapop /etc/logcheck/ignore.d.server/telnetd /etc/logcheck/ignore.d.server/tftpd /etc/logcheck/ignore.d.server/thy /etc/logcheck/ignore.d.server/ucd-snmp /etc/logcheck/ignore.d.server/upsd /etc/logcheck/ignore.d.server/uptimed /etc/logcheck/ignore.d.server/userv /etc/logcheck/ignore.d.server/vsftpd /etc/logcheck/ignore.d.server/watchdog /etc/logcheck/ignore.d.server/wu-ftpd /etc/logcheck/ignore.d.server/xinetd /etc/logcheck/ignore.d.workstation /etc/logcheck/ignore.d.workstation/automount /etc/logcheck/ignore.d.workstation/bind /etc/logcheck/ignore.d.workstation/bluetooth-alsa /etc/logcheck/ignore.d.workstation/bluez-utils /etc/logcheck/ignore.d.workstation/bonobo /etc/logcheck/ignore.d.workstation/dhcpcd /etc/logcheck/ignore.d.workstation/francine /etc/logcheck/ignore.d.workstation/gconf /etc/logcheck/ignore.d.workstation/gdm /etc/logcheck/ignore.d.workstation/hald /etc/logcheck/ignore.d.workstation/hcid /etc/logcheck/ignore.d.workstation/ifplugd /etc/logcheck/ignore.d.workstation/ippl /etc/logcheck/ignore.d.workstation/kdm /etc/logcheck/ignore.d.workstation/kernel /etc/logcheck/ignore.d.workstation/laptop-mode-tools /etc/logcheck/ignore.d.workstation/libmtp-runtime /etc/logcheck/ignore.d.workstation/libpam-gnome-keyring /etc/logcheck/ignore.d.workstation/logcheck /etc/logcheck/ignore.d.workstation/login /etc/logcheck/ignore.d.workstation/net-acct /etc/logcheck/ignore.d.workstation/nntpcache /etc/logcheck/ignore.d.workstation/polypaudio /etc/logcheck/ignore.d.workstation/postfix /etc/logcheck/ignore.d.workstation/ppp /etc/logcheck/ignore.d.workstation/proftpd /etc/logcheck/ignore.d.workstation/pump /etc/logcheck/ignore.d.workstation/sendfile /etc/logcheck/ignore.d.workstation/slim /etc/logcheck/ignore.d.workstation/squid /etc/logcheck/ignore.d.workstation/udev /etc/logcheck/ignore.d.workstation/wdm /etc/logcheck/ignore.d.workstation/winbind /etc/logcheck/ignore.d.workstation/wpasupplicant /etc/logcheck/ignore.d.workstation/xdm /etc/logcheck/ignore.d.workstation/xlockmore /etc/logcheck/logcheck.conf /etc/logcheck/logcheck.logfiles /etc/logcheck/violations.d /etc/logcheck/violations.d/kernel /etc/logcheck/violations.d/smartd /etc/logcheck/violations.d/su /etc/logcheck/violations.d/sudo /etc/logcheck/violations.ignore.d /etc/logcheck/violations.ignore.d/logcheck-su /etc/logcheck/violations.ignore.d/logcheck-sudo /etc/tmpfiles.d/logcheck.conf /usr/bin/logcheck-test /usr/sbin/logcheck /usr/sbin/logtail /usr/sbin/logtail2 /usr/share/doc/logcheck-1.3.15 /usr/share/doc/logcheck-1.3.15/LICENSE /usr/share/doc/logcheck-1.3.15/README-psionic /usr/share/doc/logcheck-1.3.15/README.Maintainer /usr/share/doc/logcheck-1.3.15/README.how.to.interpret /usr/share/doc/logcheck-1.3.15/README.keywords /usr/share/doc/logcheck-1.3.15/README.logcheck /usr/share/doc/logcheck-1.3.15/README.logcheck-database /usr/share/doc/logcheck-1.3.15/README.logtail /usr/share/doc/logcheck-1.3.15/logcheck-test.1 /usr/share/doc/logcheck-1.3.15/logcheck.sgml /usr/share/doc/logcheck-1.3.15/logtail.8 /usr/share/doc/logcheck-1.3.15/logtail2.8 /usr/share/doc/logcheck-1.3.15/tools /usr/share/doc/logcheck-1.3.15/tools/log-summary-ssh /usr/share/logtail /usr/share/logtail/detectrotate /usr/share/logtail/detectrotate/10-savelog.dtr /usr/share/logtail/detectrotate/20-logrotate.dtr /usr/share/logtail/detectrotate/30-logrotate-dateext.dtr /usr/share/man/man1/logcheck-test.1.gz /usr/share/man/man8/logcheck.8.gz /usr/share/man/man8/logtail.8.gz /usr/share/man/man8/logtail2.8.gz /var/lib/logcheck /var/lock/logcheck