January 2005
Intermediate to advanced
544 pages
23h 44m
English
Content preview from Linux Server Security, Second Edition
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
406
Chapter 12
CHAPTER 12
System Log
Management and
Monitoring
Whatever else you do to secure a Linux system, it must have comprehensive, accu-
rate, and carefully watched logs. Logs serve several purposes. First, they help to trou-
bleshoot all kinds of system and application problems. Second, they provide valuable
early warning signs of system abuse. Third, after all else fails (whether that means a
system crash or a system compromise), logs can provide us with crucial forensic
data.
This chapter is about making sure your system processes and critical applications log
the events and states you’re interested in and dealing with this data once it’s been
logged. The two logging tools we’ll cover are syslog and the more powerful Syslog-ng
(“syslog new generation”). In the monitoring arena, we’ll discuss Swatch (the Simple
Watcher), a powerful Perl script that monitors logs in real time and takes action on
specified events, plus a few “offline” log-reporting tools.
syslog
syslog is the tried-and-true workhorse of Unix logging utilities. It accepts log data
from the kernel (by way of klogd), from any and all local process, and even from pro-
cesses on remote systems. It’s flexible as well, allowing you to determine what gets
logged and where it gets logged to.
A preconfigured syslog installation ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.