How to use log management tools in Linux systems

In the Linux operating system, log management is a very important job, especially for system administrators, it can help them effectively diagnose and solve various problems. This article will introduce some commonly used log management tools and how to use them in Linux systems.

1. Syslog-ng
   Syslog-ng is a powerful, highly customizable logging engine that helps users aggregate log data from various devices and applications and Send them to a remote server or save them locally if needed.

Install Syslog-ng:
In Debian or Ubuntu systems, you can install Syslog-ng using the following command:

sudo apt-get update
sudo apt- get install syslog-ng

In CentOS or RHEL system, you can use the following command to install:

sudo yum install syslog-ng

Configure Syslog-ng:
Before configuring Syslog-ng, you first need to create a configuration file. In this file you can define how to handle messages from various devices and applications, and specify to which remote server or local file these messages are sent.

The following is a sample configuration file:

@version: 3.27
@include "scl.conf"

Accept all logs from 192.168.1.1

source s_network {
tcp(ip("192.168.1.1") port(514));
udp(ip("192.168.1.1") port(514));
};

Accept local log

source s_local {
system();
internal();
};

Write log to local file

destination d_local {
file("/var/log/messages" dir_perm(0750) create_dirs(yes) perm(0640) owner(root) group(adm));
};

Send logs to the remote server

destination d_remote {
udp("192.168.1.2" port(514));
};

Send all data from s_network and The logs of s_local are sent to d_local and d_remote

log { source(s_network, s_local); destination(d_local, d_remote); };

2. Logrotate
   Logrotate is a commonly used Log management utility that helps users retain and manage log files automatically. It works by periodically archiving or deleting old log files and creating new log files.

Installing Logrotate:
In Debian or Ubuntu systems, you can use the following command to install Logrotate:

sudo apt-get update
sudo apt-get install logrotate

In CentOS or RHEL systems, you can use the following command to install:

sudo yum install logrotate

Configure Logrotate:
Before configuring Logrotate, you first need to create a configuration document. How log files are managed can be defined in this file.

The following is a sample configuration file:

/var/log/messages {
rotate 7 #Keep 7 old log files
daily #Run once a day
compress #Compress old log files
delaycompress #Keep the latest log file for one cycle before compression
missingok #Do not issue a warning message even if the log file does not exist
postrotate #Command executed after log rotation

/etc/init.d/syslog-ng reload > /dev/null

endscript
}

/var/log/nginx/*.log {
rotate 7
daily
compress
delaycompress
missingok
notifempty #Rotate the log file even if it is empty
sharedscripts #Run the same script once before and after rotation
postrotate

systemctl reload nginx > /dev/null

endscript
}

3. Systemd Journal
   Systemd Journal is a logging service that helps users collect and manage system log files in a transparent manner. It uses binary log format to store log data, thereby improving the efficiency of log reading and indexing.

Systemd Journal is very simple to install and configure as it is already integrated into modern Linux distributions. If you want to view the system log, you can use the journalctl command:

journalctl -f #View the log in real time
journalctl -u nginx #View the logs related to Nginx
journalctl -n 10 #View the last 10 Log entries

Before using Systemd Journal, please note the following points:

• Systemd Journal stores log files in the /var/log/journal directory by default, so sufficient Disk space to store log files.
• Systemd Journal also supports sending log data to a remote server for analysis and backup.

Summary
This article introduces commonly used log management tools in Linux systems, including Syslog-ng, Logrotate and Systemd Journal. These tools can help users better manage and retain log files, and find and solve various problems in a timely manner. For system administrators, it is essential to master the basic use of these tools.

The above is the detailed content of How to use log management tools in Linux systems. For more information, please follow other related articles on the PHP Chinese website!