What's changed: Initial version (topic 1.09, subtopics 1.09.1–1.09.3)
4.2System Logging
Learn collecting, querying, and maintaining logs: rsyslog (facilities, priorities, and actions in rsyslog.conf, forwarding to a central log server), the systemd journal (journalctl queries and filters, journald.conf, /var/log/journal/), manual entries (logger, systemd-cat), and rotation with logrotate (/etc/logrotate.conf, /etc/logrotate.d/).
Incident response always starts with reading the logs (weight 5 in this topic). Modern Linux runs the systemd journal and traditional rsyslog side by side—exams cover querying both, plus growth control (logrotate).
4.2.1rsyslog: facilities and priorities
- rsyslogd is the standard syslog daemon. Rules in rsyslog.conf read "facility.priority action" (e.g.,
mail.err /var/log/mail.err). - A facility classifies the source (auth, authpriv, cron, daemon, kern, mail, user, local0–7); a priority is the severity (low→high: debug, info, notice, warning, err, crit, alert, emerg). A rule matches that severity and above.
- Actions write to files (/var/log/…) or forward to a central log server:
@host(UDP),@@host(TCP)—the receiver enables reception in its rsyslog. - Write manually with logger (
logger -p user.err "test"—from scripts into syslog) and systemd-cat (pipe a command's output into the journal).
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.