AIX系统日志学习笔记之二

AIX有一个特殊的系统守护进程，syslogd，用于记录系统信息，配置文件在/etc/syslog.conf.这个文件描述syslogd守护进程发送信息时的目的地、激活事件等。

还有一个/etc/syslog.pid文件与syslog.conf配合，syslog.pid只有一行内容，syslogd守护进程的进程ID，可以用来终止或者配置日志守护进程。

我们可以定制/etc/syslog.conf文件，可以定义系统信息的目的地，反映机制等

#cat /etc/syslog.conf

# @(#)34 1.11.2.1 src/bos/etc/syslog/syslog.conf, cmdnet,bos61N, n2011_13B1 2/21/11 04:02:04

#IBM_PROLOG_BEGIN_TAG

# This is anautomatically generated prolog.

#

# bos61Nsrc/bos/etc/syslog/syslog.conf 1.11.2.1

#

# LicensedMaterials - Property of IBM

#

# COPYRIGHTInternational Business Machines Corp. 1988,1989

# All RightsReserved

#

# US GovernmentUsers Restricted Rights - Use, duplication or

# disclosurerestricted by GSA ADP Schedule Contract with IBM Corp.

#

#IBM_PROLOG_END_TAG

#

#COMPONENT_NAME: (CMDNET) Network commands.

#

# FUNCTIONS:

#

# ORIGINS: 27

#

# (C) COPYRIGHTInternational Business Machines Corp. 1988, 1989

# All RightsReserved

# LicensedMaterials - Property of IBM

#

# US GovernmentUsers Restricted Rights - Use, duplication or

# disclosurerestricted by GSA ADP Schedule Contract with IBM Corp.

#

#/etc/syslog.conf - control output of syslogd

#

#

# Each line mustconsist of two parts:-

#

# 1) A selectorto determine the message priorities to which the

# line applies

# 2) An action.

#

# Each line cancontain an optional part:-

#

# 3) Rotation.

#

# The fieldsmust be separated by one or more tabs or spaces.

#

# format:

#

#<msg_src_list> <destination> [rotate [size <size> k|m] [files<files>] [time <time> h|d|w|m|y] [compress] [archive<archive>]]

#

# where<msg_src_list> is a semicolon separated list of<facility>.<priority>

# where:

#

#<facility> is:

# * - all (except mark)

# mark - time marks

功能可选项

# kern,user,mail,daemon, auth,... (seesyslogd(AIX Commands Reference))

#

#<priority> is one of (from high to low):

错误优先级

# emerg/panic,alert,crit,err(or),warn(ing),notice,info,debug

# (meaning all messages of this priority orhigher)

#

#<destination> is:

# /filename - log to this file

# username[,username2...] - write touser(s)

# @hostname - send to syslogd on thismachine

# * - send to all logged in users

#

# [rotate [size<size> k|m] [files <files>] [time <time> h|d|w|m|y][compress] [archive <archive>]] is:

# If <destination> is a regular fileand the word "rotate" is

# specified, then the <destination>is limited by either

# <size> or <time>, or both<size> and <time>. The <size> causes

# the <destination> to be limited to<size>, with <files> files

# kept in the rotation. The <time>causes the <destination> to be rotated after

# <time>. If both <time> and<size> are specified then logfiles

# will be rotated once the the logfilesize exceeds the <size>

# or after <time>, whichever isearlier. The rotated filenames

# are created by appending a period and anumber to <destination>,

# starting with ".0".

#

# If compress option is specified then thelogfile names will be

# generated with a ".Z"extension. The files keyword will be applicable

# to the logfiles which are currentlyunder rotation. For example

# if we specify the compress option thenonly fileis with ".Z" extension

# will be under rotation and number ofsuch files will be limited by

# <files> files. Any logfiles withan extension other than ".Z"

# will not be under the rotation schemeand thus will not be within

# the limit of <files> files.Similarly if we remove the compress

# option then the files which have beengenerated with ".Z" extension

# will no longer be the part of rotationscheme and will not be limited

# by the <files> files.

#

# The minimum size that can be specifiedis 10k, the minimum

# number of files that can be specified is2. The default

# size is 1m (meg) and the default for<files> is unlimited.

# Therefore, if only "rotate" isspecified, the log will be

# rotated with <size> = 1m.

# The compress option means that rotatedlog files that are not

# in use will be compressed.

# The archive option will save rotated logfiles that are not

# in use to <archive>.

# The default is not to rotate log files.

#

# example:

# "mailmessages, at debug or higher, go to Log file. File must exist."

# "allfacilities, at debug and higher, go to console"

# "allfacilities, at crit or higher, go to all users"

# mail.debug /usr/spool/mqueue/syslog

# *.debug /dev/console

# *.crit *

# *.debug /var/log/syslog.out rotate size 100k files 4

# *.crit /var/log/syslog.out rotate time 1d

*.info /var/adm/ras/syslog.caarotate size 1m files 10

/etc/syslog.conf可以定制系统日志的产生和输出，编辑之后需要重启syslogd,才能生效。

下面是一些基本启动和关闭的命令：

#

# lssrc -s syslogd

Subsystem Group PID Status

syslogd ras 5177376 active

# cat /etc/syslog.pid

5177376

# ps -ef | grep syslogd

root 5177376 2162834 0 Feb 01 - 0:04 /usr/sbin/syslogd

root 5898452 5767218 0 10:49:35 pts/1 0:00 grep syslogd

# stopsrc -s syslogd

0513-044 Thesyslogd Subsystem was requested to stop.

# ps -ef | grep syslogd

root 5898454 5767218 0 10:50:01 pts/1 0:00 grep syslogd

# startsrc -s syslogd

0513-059 Thesyslogd Subsystem has been started. Subsystem PID is 5898456.

# ps -ef | grep syslogd

root 5898456 2162834 0 10:50:09 - 0:00 /usr/sbin/syslogd

root 7209178 5767218 0 10:50:20 pts/1 0:00 grep syslogd

#

定制实例：

1 、将调试级或以上的所有邮件功能消息记录到文件 /tmp/mailsyslog，可以输入以下命令：

mail.debug /tmp/mailsyslog

其中：

mail 是功能。

debug 是优先级。

/tmp/mailsyslog 是目标。

2、将除来自邮件功能以外的所有系统消息发送到名为 rigil 的主机（此处可以直接使用IP地址），可以输入以下命令：

*.debug;mail.none @rigil

其中：

* 和 mail 是功能。

debug 和 none 是优先级。

@rigil 是目标。

3、将来自所有功能的emerg 优先级的消息和来自邮件及守护进程的 crit 及以上优先级的消息发送到用户nick 和 jam，可以输入以下命令：

*.emerg;mail,daemon.crit nick, jam

其中：

*、mail 和 daemon 是功能。

emerg 和 crit 是优先级。

nick 和 jam 是目标。

4、将所有邮件功能消息发送到所有用户的终端屏幕，可以输入以下命令：

mail.debug *

其中：

mail 是功能。

debug 是优先级。

* 是目标。