Ubuntu系统日志

一、指定系统日志路径到：  /var/log/messages

1、默认系统日志

root@HDController:~# tail -1000 /var/log/syslog
Oct 20 06:26:01 HDController CRON[6071]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:27:01 HDController CRON[6085]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:28:01 HDController CRON[6099]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:29:01 HDController CRON[6114]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:30:01 HDController CRON[6128]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:31:01 HDController CRON[6144]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:32:01 HDController CRON[6158]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:33:01 HDController CRON[6172]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:34:01 HDController CRON[6186]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:35:01 HDController CRON[6200]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:36:01 HDController CRON[6214]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:37:01 HDController CRON[6228]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:38:01 HDController CRON[6243]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:39:01 HDController CRON[6257]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)

2、系统默认引用路径配置文件地址

root@HDController:~# vi /etc/rsyslog.d

" ============================================================================
" Netrw Directory Listing                                        (netrw v155)
"   /etc/rsyslog.d
"   Sorted by      name
"   Sort sequence: [/]$,<core\%(.d+)=>,.h$,.c$,.cpp$,~=*$,*,.o$,.obj$,.info$,.swp
"   Quick Help: <F1>:help  -:go up dir  D:delete  R:rename  s:sort-by  x:special
" ==============================================================================
../                                                                                                
./
20-ufw.conf
50-default.conf  #系统默认日志路径
~                                                                                                  
~                         

3、更改系统默认日志路径

root@HDController:~# vi /etc/rsyslog.d/50-default.conf 
#  Default rules for rsyslog.
#
#			For more information see rsyslog.conf(5) and /etc/rsyslog.conf

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*			/var/log/auth.log
#*.*;auth,authpriv.none		-/var/log/syslog  #注释掉这行
#cron.*				/var/log/cron.log
#daemon.*			-/var/log/daemon.log
kern.*				-/var/log/kern.log
#lpr.*				-/var/log/lpr.log
mail.*				-/var/log/mail.log
#user.*				-/var/log/user.log

#add system log at 2017-10-20
*.info;mail.none;authpriv.none;cron.none /var/log/messages

#添加完成，reboot 系统就会生效。

4、查看系统日志

root@HDController:~# tail -100 /var/log/messages
Oct 20 06:26:01 HDController CRON[6071]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:27:01 HDController CRON[6085]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:28:01 HDController CRON[6099]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:29:01 HDController CRON[6114]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:30:01 HDController CRON[6128]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:31:01 HDController CRON[6144]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:32:01 HDController CRON[6158]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:33:01 HDController CRON[6172]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:34:01 HDController CRON[6186]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:35:01 HDController CRON[6200]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:36:01 HDController CRON[6214]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:37:01 HDController CRON[6228]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:38:01 HDController CRON[6243]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)
Oct 20 06:39:01 HDController CRON[6257]: (root) CMD (sudo /www/gxycloud/init.d/serverReset)