第 15 章 Logs 分析

过程 15.1. logwatch 安装步骤:

1. Install

   Ubuntu 7.10

   netkiller@shenzhen:/etc/webmin$ apt-cache search logwatch
   fwlogwatch - Firewall log analyzer
   logwatch - log analyser with nice output written in Perl
   					

   apt-get install

   # apt-get install logwatch
   					

   the logwatch has been installed, it should create a file in '/etc/cron.daily/00logwatch'.

2. config

   $ sudo cp /usr/share/logwatch/default.conf/logwatch.conf  /etc/logwatch/conf/logwatch.conf
   $ sudo mkdir /var/cache/logwatch
   $ sudo vim /etc/logwatch/conf/logwatch.conf
   					

   mail to

   # Default person to mail reports to.  Can be a local account or a
   # complete email address.
   MailTo = root, openunix@163.com, other@example.com
   					

   To change detail level for the report

   # The default detail level for the report.
   # This can either be Low, Med, High or a number.
   # Low = 0
   # Med = 5
   # High = 10
   Detail = High
   					

   Crontab

   netkiller@shenzhen:~$ cat /etc/cron.daily/00logwatch
   #!/bin/bash
   
   #Check if removed-but-not-purged
   test -x /usr/share/logwatch/scripts/logwatch.pl || exit 0
   
   #execute
   /usr/sbin/logwatch
   					

3. The logwatch is command, you can run it.

   
    logwatch --print 
   

   单独查看某个服务，比如 SSH 登录信息

   logwatch --service sshd --print