Configure Linux Components   «Prev  Next»
Lesson 2Examining system logs
Objective Examine contents of System Logs for Significant Events
Before you begin looking through logfiles for significant events, you must know the logfiles' format. Most Linux logfiles have a common, fixed format that has four elements
  1. The date and time of the message
  2. The hostname from where the message came, which is important when you have enabled centralized system logging
  3. The name of the application or subsystem from where the message came--for example, kernel, ftpd, and so on
  4. The actual message,>which is the remainder of the line following the colon

The MouseOver below shows typical entries from a /var/log/messages logfile.
Log Message Main
Log Message Out

Logfiles Used For Trouble Shooting
The xferlog logfile has its own format. Check the xferlog man page for a description of each field.
Looking for significant events
View Table
Examining the system logs is an important part of system administration. To ensure that problems are caught and resolved in a timely fashion, you should check your system's logs for significant events. Click the View Table button to see how to identify commonly logged, significant events
If you have built a monolithic kernel for your firewall (strongly suggested), check for module insertion activity with grep insmod /var/log/messages.
A monolithic kernel should not have any modules inserted into it; if someone tried, it might be a sign of security compromise.
The next lesson explains how to configure the system log