Syslog and Log Files

This contains links to information used in the lectures.

Logging Policies

• Throw away all data immediately
• Reset log files at periodic intervals
• Rotate log files - keep data for fixed time
• Compress and archive files to backup media

• Throw away all data immediately or delete files periodically
  Not recommended since accounting (logged) information useful in detection of
  • break-ins or other questionable activity
  • hardware and software problems
  Should keep for some time (2 months) since you may not realize immediately that there is a problem. Allowing log files to grow until bothersome then deleting not a good practice, since you lose all history after deletion.
• Rotate log files - keep data for fixed time
  This is most common practice.
  • Store each day's log on separate file
  • Rotate files keeping (usually a week) of files for example logfile.1, logfile.2,..., logfile.7 etc.
  • Each day logfile.7 will be lost
  • Perhaps compress older files - using compress or other utility.
  • Example script for 3 day rotation:

    
    #!/bin/sh
    cd /var/log
    mv logfile.2 logfile.3
    mv logfile.1 logfile.2
    mv logfile logfile.1
    cat /dev/null > logfile
    

  • May need to run rotation script from cron as log files' owner
  • Log files may also be date specific (logfile.thurs or logfile.mar7) - harder to implement in scripts
  • Caution: some daemons keep log files open. If the script above is used the data will disappear instead of going to the new log file. This is because deleting a file with open file descriptor does not cause the contents to be deleted until the file descriptor is closed.
    Such daemons must be signaled or killed and restarted.
  • Example with compression and signal:

    
    #!/bin/sh
    cd /var/log
    mv logfile.2.Z logfile.3.Z
    mv logfile.1.Z logfile.2.Z
    mv logfile logfile.1
    cat /dev/null > logfile
    kill -signal pid
    compress logfile.1
    

  • Logging for all machines on a net can be done centrally on a NFS mounted partition (/var/log/ for example). Note that if the machine with this disk is down or unreachable this may cause problems.
• Compress and archive files to backup media
  • All accounting data and log files may be archived - usually for audit purposes
  • Should really rotate to disk first - faster access, less frequent backups
  • Can use normal backup or separate tapes. Note: may need to keep for longer than backups.

Location of Log Files

• as command line options
• in configuration files
• configured at compile time
• hardcoded in programs

• Many log files are in /var/adm
• Log files have mode 644, but some sites reduce to 600
• Never give write permission except to owner
• sulog, authlog, sudo.log should have mode 600
• mqueue/syslog and pacct could also be restricted

Do NOT manage

Vendor Specific Locations

HP-UX 9.XX

SunOS

HP-UX 10.XX

SYSLOG - the system event logger

• liberate programmers from mechanics of writing log files
• allow administrators to control logging more efectively

• messges to sorted by source and severity level
• messages to be routed to log files, users' terminals, other machines. The ability to centralize logging is one of its most useful functions.

• syslogd and /etc/syslog.conf - the daemon that does logging and its configuration file
• openlog, syslog, closelog - library routines that programmers use to send data to syslog
• logger - a user-level command for submitting log entries

syslogd

syslogd creates the file syslog.pid containing a single line with its process ID. This can be used to kill or reconfigure syslogd. It is in /var/run/ on HP-UX 10.XX, /etc on HP-UX 9.XX and SunOS.

To kill syslogd, send it a terminate signal:

           kill `cat /var/run/syslog.pid`

To make syslogd, re-read its configuration file, send it a HANGUP signal:

           kill -HUP `cat /var/run/syslog.pid`

Do not try to compress or rotate log files that syslog has open. Some vendors supply a skeletal rotation script - another rotz is on the CD.

Configuring syslogd

. Lines in the configuration file consist of a selector to determine the message priorities to which the line applies and an action. The action field is separated from the selector by one or more tabs.

selector<TAB>action

For example:

mail.info	/var/log/maillog

Note that separators must be <TAB>s not blanks. Note also that cutting and pasting using X converts <TAB>s to blanks thus introducing invisible errors which may be difficult to detect. Selectors are semicolon separated lists of priority specifiers. Each priority has a facility indicating the subsystem that generated the message, a dot, and a level indicating the severity of the message. Symbolic names can be used. An asterisk selects all facilities. All messages of the specified level or higher (greater severity) are selected. More than one facility can be selected, using commas to separate them. For example:

           *.emerg;mail,daemon.crit

selects all facilities at the emerg level and the mail and daemon facilities at the crit level. The additional facility mark has a message at priority LOG_INFO sent to it every 20 minutes (this can be changed with the -m flag). This can be useful when trying to determine when a machine has crashed at night. The mark facility is not enabled by a facility field containing an asterisk. The level none can be used to disable a particular facility. For example,

           *.debug;mail.none

selects all messages except mail messages. In general, selectors are ORed together. However selectors with a level of none excludes the listed facilties regardless of other selectors. The known facilities and levels recognized by syslogd are those listed in syslog(3C) converted to lowercase without the leading LOG_.

The second part of each line describes where the message is to be logged if this line is selected. There are four forms:

• A file name (beginning with a leading slash). The file is opened in append mode. If the file does not exist, it is created.
• A host name preceded by an @ character. Selected messages are forwarded to the syslogd on the named host. The hostname must be resolvable to an IP address using DNS or NIS.
• A comma-separated list of users. Selected messages are written to those users' terminals if they are logged in.
• An asterisk. Selected messages are written to the terminals of all logged-in users.

Blank lines and lines beginning with a # character are ignored.

For example, the configuration file:

 kern,mark.debug   /dev/console
 mail.debug        /var/adm/syslog/mail.log
 *.info;mail.none  /var/adm/syslog/syslog.log
 *.alert /dev/console
 *.alert root,eric,kridle
 *.emerg *
 *.emerg @admin

logs all kernel messages and 20 minute marks onto the system console, all mail system messages to /var/adm/syslog/mail.log, and all messages at info and above, except mail messages, to the file /var/adm/syslog/syslog.log. Messages at alert and above are logged to the console and to the users root, eric, and kridle if they are logged in. emerg messages are written to all logged-in users' terminals, and forwarded to the host admin. Only a superuser can invoke syslogd.

• SunOS syslog.conf
• HP-UX 9.XX syslog.conf
• HP-UX 10.XX syslog.conf

Designing a Logging Scheme

• At small site log locally
• On large net log centrally
  Hopefully makes logs unavailable to hackers. Can still be spoofed.
• Choose a stable machine for logging server.
  Physically secure. Few logins. Use generic syslog.conf elsewhere.
• Log to system administrators screens, possibly using pseudo-login with restricted shell.

Software that uses Syslog

See Table 12.5 in book.

Debugging syslog

• Use logger to test changes in syslogd configuration file, for example if added:

  local5.warning <TAB>/tmp/evi.log
  

  use

  logger -p local5.warning "test message"
  

• Early versions of syslogd have a constant NLOGS which specifies maximum number of actions in syslog.conf. Usually 20. syslogd ignores extra actions.
• MAXUNAMES limits number of users who can be destination of message
• Use -d option of syslogd to display table of actions etc.
• Be careful about logging to /dev/console. If the console is VT100 and output is stopped (^S) then call to syslog will block, and system will slow to a crawl.
• Suns may send console output to boot ROM - slows down machine

Using syslog in programs

See book for examples.

---

---

---

Paul A. Farrell
Thu Mar 7 15:10:34 EST 1996