12:46:04
|
#vi /etc/rsyslog.conf
|
| /l3/users/eb/2009/linux3/root :1 :2 :3 :4 :5 :6 :7 :8 :9 :10 :11 :12 :13 :14 :15 :16 :17 :18 :19 :20 :21 :22 :23 :24 :25 :26 :27 :28 :29 :30 :31 :32 :33 :34 :35 :36 :37 :38 |
|
|
#!/etc/in
/etc/init.d/rsyslog restart Stopping enhanced syslogd: rsyslogd. Starting enhanced syslogd: rsyslogd. |
|
#!/etc/in
/etc/init.d/rsyslog restart Stopping enhanced syslogd: rsyslogd. Starting enhanced syslogd: rsyslogd. |
|
#tail -f /var/log/messages
May 27 12:35:59 linux3 kernel: imklog 3.22.0, log source = /proc/kmsg started. May 27 12:35:59 linux3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="22826" x-info="http://www.rsyslog.com"] restart May 27 12:36:27 linux3 console: Test message from linux3 host May 27 12:38:15 linux3 console: Test message from linux3 host May 27 12:44:01 linux3 kernel: Kernel logging (proc) stopped. May 27 12:44:01 linux3 kernel: imklog 3.22.0, log source = /proc/kmsg started. May 27 12:44:01 linux3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="22826" x-info="http://www.rsyslog.com"] restart May 27 12:45:08 linux3 console: Test message from linux3 host May 27 12:46:20 linux3 kernel: imklog 3.22.0, log source = /proc/kmsg started. May 27 12:46:20 linux3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="23083" x-info="http://www.rsyslog.com"] restart May 27 12:47:54 linux4 kernel: imklog 3.22.0, log source = /proc/kmsg started. May 27 12:47:54 linux4 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="11311" x-info="http://www.rsyslog.com"] restart May 27 12:48:00 linux4 console: privet on LN4 May 27 12:48:05 linux4 console: privet on LN4 ^C |
|
#tail -f /var/log/messages
May 27 12:35:59 linux3 kernel: imklog 3.22.0, log source = /proc/kmsg started. May 27 12:35:59 linux3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="22826" x-info="http://www.rsyslog.com"] restart May 27 12:36:27 linux3 console: Test message from linux3 host May 27 12:38:15 linux3 console: Test message from linux3 host May 27 12:44:01 linux3 kernel: Kernel logging (proc) stopped. May 27 12:44:01 linux3 kernel: imklog 3.22.0, log source = /proc/kmsg started. May 27 12:44:01 linux3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="22826" x-info="http://www.rsyslog.com"] restart May 27 12:45:08 linux3 console: Test message from linux3 host May 27 12:46:20 linux3 kernel: imklog 3.22.0, log source = /proc/kmsg started. May 27 12:46:20 linux3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="23083" x-info="http://www.rsyslog.com"] restart May 27 12:47:54 linux4 kernel: imklog 3.22.0, log source = /proc/kmsg started. May 27 12:47:54 linux4 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="11311" x-info="http://www.rsyslog.com"] restart May 27 12:48:00 linux4 console: privet on LN4 May 27 12:48:05 linux4 console: privet on LN4 ^C |
|
#tail -f /var/log/messages
May 27 12:44:01 linux3 kernel: imklog 3.22.0, log source = /proc/kmsg started.
May 27 12:44:01 linux3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="22826" x-info="http://www.rsyslog.com"] restart
May 27 12:45:08 linux3 console: Test message from linux3 host
May 27 12:46:20 linux3 kernel: imklog 3.22.0, log source = /proc/kmsg started.
May 27 12:46:20 linux3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="23083" x-info="http://www.rsyslog.com"] restart
May 27 12:47:54 linux4 kernel: imklog 3.22.0, log source = /proc/kmsg started.
May 27 12:47:54 linux4 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="11311" x-info="http://www.rsyslog.com"] restart
May 27 12:48:00 linux4 console: privet on LN4
May 27 12:48:05 linux4 console: privet on LN4
May 27 12:48:58 10.0.35.100 test
May 27 12:49:05 10.0.35.100 test
May 27 12:49:36 linux16 test
May 27 12:49:45 10.0.35.100 00000000 13 9a 45 ee 69 96 02 e3 f7 12 c9 7e 85 08 7b 0f |..E.i......~..{.|#01200000010 d5 1a 04 6b 01 7f 01 2f 45 b6 0c 83 c8 d5 29 ea |...k.../E.....).|#01200000020 88 1c ff 21 62 37 00 22 f5 45 5d d6 ef 53 77 02 |...!b7.".E]..Sw.|#01200000030 1c d0 64 71 4d 84 7e 60 a5 60 6b ba 2b 29 7b 3a |..dqM.~`.`k.+){:|#01200000040 41 6b 01 44 9b 5f 00 af a5 ad ca f
May 27 12:49:50 linux11 test
^C
|
|
#tail -f /var/log/messages
May 27 12:44:01 linux3 kernel: imklog 3.22.0, log source = /proc/kmsg started.
May 27 12:44:01 linux3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="22826" x-info="http://www.rsyslog.com"] restart
May 27 12:45:08 linux3 console: Test message from linux3 host
May 27 12:46:20 linux3 kernel: imklog 3.22.0, log source = /proc/kmsg started.
May 27 12:46:20 linux3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="23083" x-info="http://www.rsyslog.com"] restart
May 27 12:47:54 linux4 kernel: imklog 3.22.0, log source = /proc/kmsg started.
May 27 12:47:54 linux4 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="11311" x-info="http://www.rsyslog.com"] restart
May 27 12:48:00 linux4 console: privet on LN4
May 27 12:48:05 linux4 console: privet on LN4
May 27 12:48:58 10.0.35.100 test
May 27 12:49:05 10.0.35.100 test
May 27 12:49:36 linux16 test
May 27 12:49:45 10.0.35.100 00000000 13 9a 45 ee 69 96 02 e3 f7 12 c9 7e 85 08 7b 0f |..E.i......~..{.|#01200000010 d5 1a 04 6b 01 7f 01 2f 45 b6 0c 83 c8 d5 29 ea |...k.../E.....).|#01200000020 88 1c ff 21 62 37 00 22 f5 45 5d d6 ef 53 77 02 |...!b7.".E]..Sw.|#01200000030 1c d0 64 71 4d 84 7e 60 a5 60 6b ba 2b 29 7b 3a |..dqM.~`.`k.+){:|#01200000040 41 6b 01 44 9b 5f 00 af a5 ad ca f
May 27 12:49:50 linux11 test
^C
|
|
#!vi
"/etc/rsyslog.conf" 117L, 2597C #$InputTCPServerRun 514 ########################### #### GLOBAL DIRECTIVES #### ########################### #$ModLoad imudp #$UDPServerRun 514 # # Use traditional timestamp format. # To enable high precision timestamps, comment out the following line. # $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # # Set the default permissions for all log files. # $FileOwner root $FileGroup adm "/etc/rsyslog.conf" 117L, 2599C written |
|
#!vi
"/etc/rsyslog.conf" 117L, 2597C #$InputTCPServerRun 514 ########################### #### GLOBAL DIRECTIVES #### ########################### #$ModLoad imudp #$UDPServerRun 514 # # Use traditional timestamp format. # To enable high precision timestamps, comment out the following line. # $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # # Set the default permissions for all log files. # $FileOwner root $FileGroup adm "/etc/rsyslog.conf" 117L, 2599C written |
|
#apt-get install netcat
Reading package lists... Done Building dependency tree Reading state information... Done The following packages were automatically installed and are no longer required: update-inetd portmap Use 'apt-get autoremove' to remove them. The following NEW packages will be installed: netcat 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. Need to get 6144B of archives. After this operation, 36.9kB of additional disk space will be used. Get:1 http://10.0.35.1 sid/main netcat 1.10-38 [6144B] Fetched 6144B in 0s (401kB/s) Selecting previously deselected package netcat. (Reading database ... 44360 files and directories currently installed.) Unpacking netcat (from .../netcat_1.10-38_all.deb) ... Setting up netcat (1.10-38) ... |
|
#apt-get install netcat
Reading package lists... Done Building dependency tree Reading state information... Done The following packages were automatically installed and are no longer required: update-inetd portmap Use 'apt-get autoremove' to remove them. The following NEW packages will be installed: netcat 0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded. Need to get 6144B of archives. After this operation, 36.9kB of additional disk space will be used. Get:1 http://10.0.35.1 sid/main netcat 1.10-38 [6144B] Fetched 6144B in 0s (401kB/s) Selecting previously deselected package netcat. (Reading database ... 44360 files and directories currently installed.) Unpacking netcat (from .../netcat_1.10-38_all.deb) ... Setting up netcat (1.10-38) ... |
|
#nc 10.0.35.100 3000 | dd of=/dev/null
^C47864+18389 records in 62805+0 records out 32156160 bytes (32 MB) copied, 2.75466 s, 11.7 MB/s |
|
#nc 10.0.35.100 3000 | dd of=/dev/null
^C23349+11579 records in 32896+0 records out 16842752 bytes (17 MB) copied, 3.95525 s, 4.3 MB/s |
|
#dd if=/dev/urandom of=/dev/null
^C11700+0 records in 11699+0 records out 5989888 bytes (6.0 MB) copied, 5.4705 s, 1.1 MB/s |
|
#dd if=/dev/urandom of=/dev/null
^C11700+0 records in 11699+0 records out 5989888 bytes (6.0 MB) copied, 5.4705 s, 1.1 MB/s |
|
#dd if=/dev/urandom of=/dev/null
^C9015+0 records in 9014+0 records out 4615168 bytes (4.6 MB) copied, 4.07742 s, 1.1 MB/s |
|
#ды ls /etc/logrotate*
/etc/logrotate.conf /etc/logrotate.d: apt aptitude dpkg exim4-base exim4-paniclog rsyslog |
|
#ды ls /etc/logrotate*
/etc/logrotate.conf /etc/logrotate.d: apt aptitude dpkg exim4-base exim4-paniclog rsyslog |
|
#cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
#compress
# packages drop log rotation information into this directory
...
create 0664 root utmp
rotate 1
}
/var/log/btmp {
missingok
monthly
create 0660 root utmp
rotate 1
}
# system-specific logs may be configured here
|
|
#cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
#compress
# packages drop log rotation information into this directory
...
create 0664 root utmp
rotate 1
}
/var/log/btmp {
missingok
monthly
create 0660 root utmp
rotate 1
}
# system-specific logs may be configured here
|
|
#cat /etc/logrotate.d/rsyslog
/var/log/syslog
{
rotate 7
daily
missingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d rsyslog reload > /dev/null
...
weekly
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
invoke-rc.d rsyslog reload > /dev/null
endscript
}
|
|
#cat /etc/logrotate.d/rsyslog
/var/log/syslog
{
rotate 7
daily
missingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d rsyslog reload > /dev/null
...
weekly
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
invoke-rc.d rsyslog reload > /dev/null
endscript
}
|
|
#apt-get install sendxmpp
Reading package lists... Done Building dependency tree Reading state information... Done The following packages were automatically installed and are no longer required: update-inetd portmap Use 'apt-get autoremove' to remove them. The following extra packages will be installed: libauthen-sasl-perl libdigest-sha1-perl libio-socket-ssl-perl libnet-libidn-perl libnet-ssleay-perl libnet-xmpp-perl libxml-stream-perl Suggested packages: ... Unpacking sendxmpp (from .../sendxmpp_1.15-1_all.deb) ... Processing triggers for man-db ... Setting up libauthen-sasl-perl (2.12-1) ... Setting up libdigest-sha1-perl (2.11-2+b1) ... Setting up libnet-ssleay-perl (1.35-2) ... Setting up libio-socket-ssl-perl (1.24-1) ... Setting up libnet-libidn-perl (0.07-1+b1) ... Setting up libxml-stream-perl (1.22-3) ... Setting up libnet-xmpp-perl (1.02-1) ... Setting up sendxmpp (1.15-1) ... |
|
#apt-get install sendxmpp
Reading package lists... Done Building dependency tree Reading state information... Done The following packages were automatically installed and are no longer required: update-inetd portmap Use 'apt-get autoremove' to remove them. The following extra packages will be installed: libauthen-sasl-perl libdigest-sha1-perl libio-socket-ssl-perl libnet-libidn-perl libnet-ssleay-perl libnet-xmpp-perl libxml-stream-perl Suggested packages: ... Unpacking sendxmpp (from .../sendxmpp_1.15-1_all.deb) ... Processing triggers for man-db ... Setting up libauthen-sasl-perl (2.12-1) ... Setting up libdigest-sha1-perl (2.11-2+b1) ... Setting up libnet-ssleay-perl (1.35-2) ... Setting up libio-socket-ssl-perl (1.24-1) ... Setting up libnet-libidn-perl (0.07-1+b1) ... Setting up libxml-stream-perl (1.22-3) ... Setting up libnet-xmpp-perl (1.02-1) ... Setting up sendxmpp (1.15-1) ... |
|
#vi ~/.sendxmpp
--- /tmp/l3-saved-3153.29676.5462 2009-05-27 14:51:49.000000000 +0300 +++ /root/.sendxmpp 2009-05-27 14:52:18.000000000 +0300 @@ -0,0 +1 @@ +swdakatest@jabber.ru:5222 swdswd |
|
#sendxmpp --help
sendxmpp version 1.15 Copyright (c) 2004 - 2005 Dirk-Jan C. Binnema Copyright (c) 2006 - 2007 Lubomir Host 'rajo' usage: sendxmpp [options] <recipient1> [<recipient2> ...] or refer to the the sendxmpp manpage |
|
#sendxmpp --help
sendxmpp version 1.15 Copyright (c) 2004 - 2005 Dirk-Jan C. Binnema Copyright (c) 2006 - 2007 Lubomir Host 'rajo' usage: sendxmpp [options] <recipient1> [<recipient2> ...] or refer to the the sendxmpp manpage |
|
#echo test | sendxmpp swdakaswd@jabber.ru
cannot read /root/.sendxmpprc: No such file or directory |
|
#echo test | sendxmpp swdakaswd@jabber.ru
cannot read /root/.sendxmpprc: No such file or directory |
|
#echo test | sendxmpp swdakaswd@jabber.ru
|
|
#ps aux | sendxmpp swdakaswd@jabber.ru
|
|
#vi /etc/X11/xorg.conf
--- /tmp/l3-saved-24823.23183.23347 2009-05-27 15:00:26.000000000 +0300 +++ /etc/X11/xorg.conf 2009-05-27 15:01:08.000000000 +0300 @@ -0,0 +1,8 @@ +Section "Device" + Identifier "Generic Video Card" + Driver "vesa" + #Driver "i810" + #Driver "nv" + #Option "RenderAccel" "true" +EndSection + |
|
#/etc/init.d/gdm restart
Stopping GNOME Display Manager: gdm. Starting GNOME Display Manager: gdm. |
|
#xit
bash: xit: command not found |
|
#~
do echo $line | sendxmpp swdakatest@jabber.ru done ~ ~ ~ ~ ~ ~ ~ ... ~ ~ ~ ~ ~ ~ ~ ~ ~ "/usr/local/bin/syslog2jabber" [New] 5L, 83C written |
|
#~
do echo $line | sendxmpp swdakatest@jabber.ru done ~ ~ ~ ~ ~ ~ ~ ... ~ ~ ~ ~ ~ ~ ~ ~ ~ "/usr/local/bin/syslog2jabber" [New] 5L, 83C written |
|
#~
do echo $line | /usr/bin/sendxmpp swdakatest@jabber.ru done ~ ~ ~ ~ ~ ~ ~ ... ~ ~ ~ ~ ~ ~ ~ ~ ~ "/usr/local/bin/syslog2jabber" 5L, 88C written |
|
#~
do echo $line | /usr/bin/sendxmpp swdakatest@jabber.ru done ~ ~ ~ ~ ~ ~ ~ ... ~ ~ ~ ~ ~ ~ ~ ~ ~ "/usr/local/bin/syslog2jabber" 5L, 88C written |
|
#apt-get install syslogng
Reading package lists... Done Building dependency tree Reading state information... Done E: Couldn't find package syslogng |
|
#apt-get install syslogng
Reading package lists... Done Building dependency tree Reading state information... Done E: Couldn't find package syslogng |
|
#apt-get install syslog-ng
Reading package lists... Done Building dependency tree Reading state information... Done The following packages were automatically installed and are no longer required: update-inetd portmap Use 'apt-get autoremove' to remove them. The following extra packages will be installed: libevtlog0 The following packages will be REMOVED: rsyslog ... Processing triggers for man-db ... Selecting previously deselected package libevtlog0. (Reading database ... 44597 files and directories currently installed.) Unpacking libevtlog0 (from .../libevtlog0_0.2.8~1-2_i386.deb) ... Selecting previously deselected package syslog-ng. Unpacking syslog-ng (from .../syslog-ng_2.0.9-4.1_i386.deb) ... Processing triggers for man-db ... Setting up libevtlog0 (0.2.8~1-2) ... Setting up syslog-ng (2.0.9-4.1) ... Starting system logging: syslog-ng. |
|
#apt-get install syslog-ng
Reading package lists... Done Building dependency tree Reading state information... Done The following packages were automatically installed and are no longer required: update-inetd portmap Use 'apt-get autoremove' to remove them. The following extra packages will be installed: libevtlog0 The following packages will be REMOVED: rsyslog ... Processing triggers for man-db ... Selecting previously deselected package libevtlog0. (Reading database ... 44597 files and directories currently installed.) Unpacking libevtlog0 (from .../libevtlog0_0.2.8~1-2_i386.deb) ... Selecting previously deselected package syslog-ng. Unpacking syslog-ng (from .../syslog-ng_2.0.9-4.1_i386.deb) ... Processing triggers for man-db ... Setting up libevtlog0 (0.2.8~1-2) ... Setting up syslog-ng (2.0.9-4.1) ... Starting system logging: syslog-ng. |
|
#ps aux | grep syslog
root 26575 0.0 0.0 3048 712 ? Ss 15:21 0:00 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 26589 0.0 0.0 3952 740 pts/9 R+ 15:21 0:00 grep syslog |
|
#ps aux | grep syslog
root 26575 0.0 0.0 3048 712 ? Ss 15:21 0:00 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 26589 0.0 0.0 3952 740 pts/9 R+ 15:21 0:00 grep syslog |
|
#tail -f /var/log/messages
May 27 12:49:05 10.0.35.100 test
May 27 12:49:36 linux16 test
May 27 12:49:45 10.0.35.100 00000000 13 9a 45 ee 69 96 02 e3 f7 12 c9 7e 85 08 7b 0f |..E.i......~..{.|#01200000010 d5 1a 04 6b 01 7f 01 2f 45 b6 0c 83 c8 d5 29 ea |...k.../E.....).|#01200000020 88 1c ff 21 62 37 00 22 f5 45 5d d6 ef 53 77 02 |...!b7.".E]..Sw.|#01200000030 1c d0 64 71 4d 84 7e 60 a5 60 6b ba 2b 29 7b 3a |..dqM.~`.`k.+){:|#01200000040 41 6b 01 44 9b 5f 00 af a5 ad ca f
May 27 12:49:50 linux11 test
May 27 12:51:14 linux3 kernel: Kernel logging (proc) stopped.
May 27 12:51:14 linux3 kernel: imklog 3.22.0, log source = /proc/kmsg started.
May 27 12:51:14 linux3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="23083" x-info="http://www.rsyslog.com"] restart
May 27 15:21:15 linux3 kernel: Kernel logging (proc) stopped.
May 27 15:21:15 linux3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="23083" x-info="http://www.rsyslog.com"] exiting on signal 15.
May 27 15:21:18 linux3 syslog-ng[26575]: syslog-ng starting up; version='2.0.9'
May 27 15:22:48 linux3 console: test_ng
^C
|
|
#tail -f /var/log/messages
May 27 12:49:05 10.0.35.100 test
May 27 12:49:36 linux16 test
May 27 12:49:45 10.0.35.100 00000000 13 9a 45 ee 69 96 02 e3 f7 12 c9 7e 85 08 7b 0f |..E.i......~..{.|#01200000010 d5 1a 04 6b 01 7f 01 2f 45 b6 0c 83 c8 d5 29 ea |...k.../E.....).|#01200000020 88 1c ff 21 62 37 00 22 f5 45 5d d6 ef 53 77 02 |...!b7.".E]..Sw.|#01200000030 1c d0 64 71 4d 84 7e 60 a5 60 6b ba 2b 29 7b 3a |..dqM.~`.`k.+){:|#01200000040 41 6b 01 44 9b 5f 00 af a5 ad ca f
May 27 12:49:50 linux11 test
May 27 12:51:14 linux3 kernel: Kernel logging (proc) stopped.
May 27 12:51:14 linux3 kernel: imklog 3.22.0, log source = /proc/kmsg started.
May 27 12:51:14 linux3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="23083" x-info="http://www.rsyslog.com"] restart
May 27 15:21:15 linux3 kernel: Kernel logging (proc) stopped.
May 27 15:21:15 linux3 rsyslogd: [origin software="rsyslogd" swVersion="3.22.0" x-pid="23083" x-info="http://www.rsyslog.com"] exiting on signal 15.
May 27 15:21:18 linux3 syslog-ng[26575]: syslog-ng starting up; version='2.0.9'
May 27 15:22:48 linux3 console: test_ng
^C
|
|
#ssh localhost
ssh: Could not resolve hostname localhost: Name or service not known |
|
#ssh localhost
ssh: Could not resolve hostname localhost: Name or service not known |
|
#ssh 127.0.0.1
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established. RSA key fingerprint is 34:6c:c2:da:38:7c:d7:17:e9:cd:17:8d:e7:cf:f1:a6. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '127.0.0.1' (RSA) to the list of known hosts. root@127.0.0.1's password: Permission denied, please try again. root@127.0.0.1's password: Permission denied, please try again. root@127.0.0.1's password: Permission denied (publickey,password). |
|
#ssh 127.0.0.1
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established. RSA key fingerprint is 34:6c:c2:da:38:7c:d7:17:e9:cd:17:8d:e7:cf:f1:a6. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '127.0.0.1' (RSA) to the list of known hosts. root@127.0.0.1's password: Permission denied, please try again. root@127.0.0.1's password: Permission denied, please try again. root@127.0.0.1's password: Permission denied (publickey,password). |
|
#ls /etc/
a2ps.cfg deluser.conf iproute2 modprobe.d rc6.d a2ps-site.cfg dhcp3 issue modules rc.local adduser.conf dictionaries-common issue.net motd rcS.d adjtime dm kbd motd.tail resolv.conf aliases dpkg kde3 mtab rmt alternatives emacs kernel nanorc rpc anacrontab email-addresses kernel-img.conf network rsyslog.conf apm environment ldap networks screenrc apt exim4 ld.so.cache nsswitch.conf scsi_id.config at.deny fonts ld.so.conf openoffice securetty ... cron.daily hesiod.conf magic.mime protocols terminfo cron.hourly host.conf mailcap purple timezone cron.monthly hostname mailcap.order python ts.conf crontab hosts.allow mailname python2.5 ucf.conf cron.weekly hosts.deny mail.rc rc0.d udev dbus-1 iceweasel manpath.config rc1.d vim debconf.conf init.d menu rc2.d wgetrc debian_version initramfs-tools menu-methods rc3.d X11 default inittab mime.types rc4.d xdg defoma inputrc mke2fs.conf rc5.d xml |
|
#ls /etc/
a2ps.cfg deluser.conf iproute2 modprobe.d rc6.d a2ps-site.cfg dhcp3 issue modules rc.local adduser.conf dictionaries-common issue.net motd rcS.d adjtime dm kbd motd.tail resolv.conf aliases dpkg kde3 mtab rmt alternatives emacs kernel nanorc rpc anacrontab email-addresses kernel-img.conf network rsyslog.conf apm environment ldap networks screenrc apt exim4 ld.so.cache nsswitch.conf scsi_id.config at.deny fonts ld.so.conf openoffice securetty ... cron.daily hesiod.conf magic.mime protocols terminfo cron.hourly host.conf mailcap purple timezone cron.monthly hostname mailcap.order python ts.conf crontab hosts.allow mailname python2.5 ucf.conf cron.weekly hosts.deny mail.rc rc0.d udev dbus-1 iceweasel manpath.config rc1.d vim debconf.conf init.d menu rc2.d wgetrc debian_version initramfs-tools menu-methods rc3.d X11 default inittab mime.types rc4.d xdg defoma inputrc mke2fs.conf rc5.d xml |
|
#tail -f /var/log/auth.log
May 27 15:22:14 linux3 su[26727]: + /dev/pts/10 root:root May 27 15:22:14 linux3 su[26727]: pam_unix(su:session): session opened for user root by (uid=0) May 27 15:24:52 linux3 sshd[27068]: reverse mapping checking getaddrinfo for localhost [127.0.0.1] failed - POSSIBLE BREAK-IN ATTEMPT! May 27 15:24:54 linux3 sshd[27068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=root May 27 15:24:55 linux3 sshd[27068]: Failed password for root from 127.0.0.1 port 37534 ssh2 May 27 15:25:00 linux3 sshd[27068]: Failed password for root from 127.0.0.1 port 37534 ssh2 May 27 15:25:03 linux3 sshd[27068]: Failed password for root from 127.0.0.1 port 37534 ssh2 May 27 15:25:03 linux3 sshd[27068]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=root May 27 15:25:11 linux3 sshd[27077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=linux4.unix.nt user=root May 27 15:25:14 linux3 sshd[27077]: Failed password for root from 192.168.15.4 port 55842 ssh2 ... May 27 16:09:52 linux3 sshd[27290]: Failed password for root from 192.168.15.4 port 33422 ssh2 May 27 16:09:52 linux3 sshd[27290]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=linux4.unix.nt user=root May 27 16:12:39 linux3 sshd[27400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=linux4.unix.nt user=root May 27 16:12:41 linux3 sshd[27400]: Failed password for root from 192.168.15.4 port 47063 ssh2 May 27 16:12:45 linux3 sshd[27400]: Failed password for root from 192.168.15.4 port 47063 ssh2 May 27 16:12:50 linux3 sshd[27400]: Failed password for root from 192.168.15.4 port 47063 ssh2 May 27 16:12:50 linux3 sshd[27400]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=linux4.unix.nt user=root May 27 16:17:01 linux3 CRON[27449]: pam_unix(cron:session): session opened for user root by (uid=0) May 27 16:17:02 linux3 CRON[27449]: pam_unix(cron:session): session closed for user root ^C |
|
#tail -f /var/log/auth.log
May 27 15:22:14 linux3 su[26727]: + /dev/pts/10 root:root May 27 15:22:14 linux3 su[26727]: pam_unix(su:session): session opened for user root by (uid=0) May 27 15:24:52 linux3 sshd[27068]: reverse mapping checking getaddrinfo for localhost [127.0.0.1] failed - POSSIBLE BREAK-IN ATTEMPT! May 27 15:24:54 linux3 sshd[27068]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=root May 27 15:24:55 linux3 sshd[27068]: Failed password for root from 127.0.0.1 port 37534 ssh2 May 27 15:25:00 linux3 sshd[27068]: Failed password for root from 127.0.0.1 port 37534 ssh2 May 27 15:25:03 linux3 sshd[27068]: Failed password for root from 127.0.0.1 port 37534 ssh2 May 27 15:25:03 linux3 sshd[27068]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=127.0.0.1 user=root May 27 15:25:11 linux3 sshd[27077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=linux4.unix.nt user=root May 27 15:25:14 linux3 sshd[27077]: Failed password for root from 192.168.15.4 port 55842 ssh2 ... May 27 16:09:52 linux3 sshd[27290]: Failed password for root from 192.168.15.4 port 33422 ssh2 May 27 16:09:52 linux3 sshd[27290]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=linux4.unix.nt user=root May 27 16:12:39 linux3 sshd[27400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=linux4.unix.nt user=root May 27 16:12:41 linux3 sshd[27400]: Failed password for root from 192.168.15.4 port 47063 ssh2 May 27 16:12:45 linux3 sshd[27400]: Failed password for root from 192.168.15.4 port 47063 ssh2 May 27 16:12:50 linux3 sshd[27400]: Failed password for root from 192.168.15.4 port 47063 ssh2 May 27 16:12:50 linux3 sshd[27400]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=linux4.unix.nt user=root May 27 16:17:01 linux3 CRON[27449]: pam_unix(cron:session): session opened for user root by (uid=0) May 27 16:17:02 linux3 CRON[27449]: pam_unix(cron:session): session closed for user root ^C |
|
#cat /etc/syslog-ng/syslog-ng.conf
source(s_all);
filter(f_auth);
destination(df_auth);
};
# *.*;auth,authpriv.none -/var/log/syslog
log {
source(s_all);
filter(f_syslog);
destination(df_syslog);
};
...
};
# daemon.*;mail.*;\
# news.crit;news.err;news.notice;\
# *.=debug;*.=info;\
# *.=notice;*.=warn |/dev/xconsole
log {
source(s_all);
filter(f_xconsole);
destination(dp_xconsole);
};
|
|
#cat /etc/syslog-ng/syslog-ng.conf
source(s_all);
filter(f_auth);
destination(df_auth);
};
# *.*;auth,authpriv.none -/var/log/syslog
log {
source(s_all);
filter(f_syslog);
destination(df_syslog);
};
...
};
# daemon.*;mail.*;\
# news.crit;news.err;news.notice;\
# *.=debug;*.=info;\
# *.=notice;*.=warn |/dev/xconsole
log {
source(s_all);
filter(f_xconsole);
destination(dp_xconsole);
};
|
|
#ps aux | grep jabb
root 27185 0.0 0.0 4688 1152 ? S 15:39 0:00 /bin/bash /usr/local/bin/syslog2jabber root 27208 0.0 0.0 3952 744 pts/9 S+ 15:40 0:00 grep jabb |
|
#ps aux | grep jabb
root 27185 0.0 0.0 4688 1152 ? S 15:39 0:00 /bin/bash /usr/local/bin/syslog2jabber root 27208 0.0 0.0 3952 744 pts/9 S+ 15:40 0:00 grep jabb |
|
#!ssh
ssh 127.0.0.1 root@127.0.0.1's password: Permission denied, please try again. root@127.0.0.1's password: Permission denied, please try again. root@127.0.0.1's password: Permission denied (publickey,password). |
# see "man logrotate" for details
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
#compress
# packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
missingok
monthly
create 0664 root utmp
rotate 1
}
/var/log/btmp {
missingok
monthly
create 0660 root utmp
rotate 1
}
# system-specific logs may be configured here
apt aptitude dpkg exim4-base exim4-paniclog rsyslog
/var/log/syslog
{
rotate 7
daily
missingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d rsyslog reload > /dev/null
endscript
}
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
rotate 4
weekly
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
invoke-rc.d rsyslog reload > /dev/null
endscript
}
source(s_all);
filter(f_auth);
destination(df_auth);
};
# *.*;auth,authpriv.none -/var/log/syslog
log {
source(s_all);
filter(f_syslog);
destination(df_syslog);
};
# this is commented out in the default syslog.conf
# cron.* /var/log/cron.log
#log {
# source(s_all);
# filter(f_cron);
# destination(df_cron);
#};
# daemon.* -/var/log/daemon.log
log {
source(s_all);
filter(f_daemon);
destination(df_daemon);
};
# kern.* -/var/log/kern.log
log {
source(s_all);
filter(f_kern);
destination(df_kern);
};
# lpr.* -/var/log/lpr.log
log {
source(s_all);
filter(f_lpr);
destination(df_lpr);
};
# mail.* -/var/log/mail.log
log {
source(s_all);
filter(f_mail);
destination(df_mail);
};
# user.* -/var/log/user.log
log {
source(s_all);
filter(f_user);
destination(df_user);
};
# uucp.* /var/log/uucp.log
log {
source(s_all);
filter(f_uucp);
destination(df_uucp);
};
# mail.info -/var/log/mail.info
log {
source(s_all);
filter(f_mail);
filter(f_at_least_info);
destination(df_facility_dot_info);
};
# mail.warn -/var/log/mail.warn
log {
source(s_all);
filter(f_mail);
filter(f_at_least_warn);
destination(df_facility_dot_warn);
};
# mail.err /var/log/mail.err
log {
source(s_all);
filter(f_mail);
filter(f_at_least_err);
destination(df_facility_dot_err);
};
# news.crit /var/log/news/news.crit
log {
source(s_all);
filter(f_news);
filter(f_at_least_crit);
destination(df_news_dot_crit);
};
# news.err /var/log/news/news.err
log {
source(s_all);
filter(f_news);
filter(f_at_least_err);
destination(df_news_dot_err);
};
# news.notice /var/log/news/news.notice
log {
source(s_all);
filter(f_news);
filter(f_at_least_notice);
destination(df_news_dot_notice);
};
# *.=debug;\
# auth,authpriv.none;\
# news.none;mail.none -/var/log/debug
log {
source(s_all);
filter(f_debug);
destination(df_debug);
};
# *.=info;*.=notice;*.=warn;\
# auth,authpriv.none;\
# cron,daemon.none;\
# mail,news.none -/var/log/messages
log {
source(s_all);
filter(f_messages);
destination(df_messages);
};
# *.emerg *
log {
source(s_all);
filter(f_emerg);
destination(du_all);
};
# daemon.*;mail.*;\
# news.crit;news.err;news.notice;\
# *.=debug;*.=info;\
# *.=notice;*.=warn |/dev/xconsole
log {
source(s_all);
filter(f_xconsole);
destination(dp_xconsole);
};
| Время первой команды журнала | 12:46:04 2009- 5-27 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Время последней команды журнала | 15:40:17 2009- 5-27 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Количество командных строк в журнале | 101 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Процент команд с ненулевым кодом завершения, % | 12.87 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Процент синтаксически неверно набранных команд, % | 2.97 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Суммарное время работы с терминалом *, час | 1.72 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Количество командных строк в единицу времени, команда/мин | 0.98 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Частота использования команд |
|
В журнал автоматически попадают все команды, данные в любом терминале системы.
Для того чтобы убедиться, что журнал на текущем терминале ведётся, и команды записываются, дайте команду w. В поле WHAT, соответствующем текущему терминалу, должна быть указана программа script.
Команды, при наборе которых были допущены синтаксические ошибки, выводятся перечёркнутым текстом:
$ l s-l bash: l: command not found |
Если код завершения команды равен нулю, команда была выполнена без ошибок. Команды, код завершения которых отличен от нуля, выделяются цветом.
$ test 5 -lt 4 |
Команды, ход выполнения которых был прерван пользователем, выделяются цветом.
$ find / -name abc find: /home/devi-orig/.gnome2: Keine Berechtigung find: /home/devi-orig/.gnome2_private: Keine Berechtigung find: /home/devi-orig/.nautilus/metafiles: Keine Berechtigung find: /home/devi-orig/.metacity: Keine Berechtigung find: /home/devi-orig/.inkscape: Keine Berechtigung ^C |
Команды, выполненные с привилегиями суперпользователя, выделяются слева красной чертой.
# id uid=0(root) gid=0(root) Gruppen=0(root) |
Изменения, внесённые в текстовый файл с помощью редактора, запоминаются и показываются в журнале в формате ed. Строки, начинающиеся символом "<", удалены, а строки, начинающиеся символом ">" -- добавлены.
$ vi ~/.bashrc
|
Для того чтобы изменить файл в соответствии с показанными в диффшоте изменениями, можно воспользоваться командой patch. Нужно скопировать изменения, запустить программу patch, указав в качестве её аргумента файл, к которому применяются изменения, и всавить скопированный текст:
$ patch ~/.bashrc |
Для того чтобы получить краткую справочную информацию о команде, нужно подвести к ней мышь. Во всплывающей подсказке появится краткое описание команды.
Если справочная информация о команде есть, команда выделяется голубым фоном, например: vi. Если справочная информация отсутствует, команда выделяется розовым фоном, например: notepad.exe. Справочная информация может отсутствовать в том случае, если (1) команда введена неверно; (2) если распознавание команды LiLaLo выполнено неверно; (3) если информация о команде неизвестна LiLaLo. Последнее возможно для редких команд.
Большие, в особенности многострочные, всплывающие подсказки лучше всего показываются браузерами KDE Konqueror, Apple Safari и Microsoft Internet Explorer. В браузерах Mozilla и Firefox они отображаются не полностью, а вместо перевода строки выводится специальный символ.
Время ввода команды, показанное в журнале, соответствует времени начала ввода командной строки, которое равно тому моменту, когда на терминале появилось приглашение интерпретатора
Имя терминала, на котором была введена команда, показано в специальном блоке. Этот блок показывается только в том случае, если терминал текущей команды отличается от терминала предыдущей.
Вывод не интересующих вас в настоящий момент элементов журнала, таких как время, имя терминала и других, можно отключить. Для этого нужно воспользоваться формой управления журналом вверху страницы.
Небольшие комментарии к командам можно вставлять прямо из командной строки. Комментарий вводится прямо в командную строку, после символов #^ или #v. Символы ^ и v показывают направление выбора команды, к которой относится комментарий: ^ - к предыдущей, v - к следующей. Например, если в командной строке было введено:
$ whoami
user
$ #^ Интересно, кто я?в журнале это будет выглядеть так:
$ whoami
user
| Интересно, кто я? |
Если комментарий содержит несколько строк, его можно вставить в журнал следующим образом:
$ whoami
user
$ cat > /dev/null #^ Интересно, кто я?
Программа whoami выводит имя пользователя, под которым мы зарегистрировались в системе. - Она не может ответить на вопрос о нашем назначении в этом мире.В журнале это будет выглядеть так:
$ whoami user
|
Комментарии, не относящиеся непосредственно ни к какой из команд, добавляются точно таким же способом, только вместо симолов #^ или #v нужно использовать символы #=
1
2
3
4
Группы команд, выполненных на разных терминалах, разделяются специальной линией.
Под этой линией в правом углу показано имя терминала, на котором выполнялись команды.
Для того чтобы посмотреть команды только одного сенса,
нужно щёкнуть по этому названию.
LiLaLo (L3) расшифровывается как Live Lab Log.
Программа разработана для повышения эффективности обучения Unix/Linux-системам.
(c) Игорь Чубин, 2004-2008