# 步骤1：查看rsyslog状态
$ sudo systemctl status rsyslog
● rsyslog.service – System Logging Service
Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2026-04-02 10:00:00 CST; 10s ago
Docs: man:rsyslogd(8)
https://www.rsyslog.com/doc/
Main PID: 1234 (rsyslogd)
Tasks: 3 (limit: 4915)
Memory: 3.5M
CGroup: /system.slice/rsyslog.service
└─1234 /usr/sbin/rsyslogd -n

# 步骤2：查看rsyslog配置文件
$ cat /etc/rsyslog.conf
# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# or latest version online at http://www.rsyslog.com/doc/rsyslog_conf.html

# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####
module(load=”imuxsock”) # provides support for local system logging
module(load=”imjournal”) # provides access to the systemd journal
module(load=”imklog”) # kernel logging
module(load=”immark”) # provides –MARK– message capability

#### GLOBAL DIRECTIVES ####
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console

# Log anything (except mail) of level info or higher.
# Don’t log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages

# The authpriv file has restricted access.
authpriv.* /var/log/secure

# Log all the mail messages in one place.
mail.* -/var/log/maillog

# Log cron stuff
cron.* /var/log/cron

# Everybody gets emergency messages
*.emerg :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler

# Save boot messages also to boot.log
local7.* /var/log/boot.log

# 步骤3：查看日志目录
$ ls -l /var/log | grep -E “messages|secure|maillog|cron|spooler|boot.log”
-rw——-. 1 root root 123456 Apr 2 10:00 /var/log/messages
-rw——-. 1 root root 12345 Apr 2 10:00 /var/log/secure
-rw——-. 1 root root 6789 Apr 2 10:00 /var/log/maillog
-rw——-. 1 root root 3456 Apr 2 10:00 /var/log/cron
-rw——-. 1 root root 2345 Apr 2 10:00 /var/log/spooler
-rw——-. 1 root root 5678 Apr 2 10:00 /var/log/boot.log

# 步骤4：查看系统日志
$ sudo tail -20 /var/log/messages
Apr 2 10:00:00 fgedu systemd[1]: Starting System Logging Service…
Apr 2 10:00:00 fgedu rsyslogd[1234]: [origin software=”rsyslogd” swVersion=”8.2102.0″ x-pid=”1234″ x-info=”http://www.rsyslog.com”] start
Apr 2 10:00:00 fgedu systemd[1]: Started System Logging Service.
Apr 2 10:00:00 fgedu NetworkManager[5678]: [1234567890abcdef] device (eth0): state change: ip-config -> ip-check
Apr 2 10:00:00 fgedu NetworkManager[5678]: [1234567890abcdef] policy: set-ipv4-dns (eth0): 192.168.1.1 8.8.8.8
Apr 2 10:00:00 fgedu NetworkManager[5678]: [1234567890abcdef] device (eth0): state change: ip-check -> secondaries
Apr 2 10:00:00 fgedu NetworkManager[5678]: [1234567890abcdef] device (eth0): state change: secondaries -> activated
Apr 2 10:00:00 fgedu dhclient[9012]: DHCPREQUEST for 192.168.1.10 on eth0 to 255.255.255.255 port 67 (xid=0x12345678)
Apr 2 10:00:00 fgedu dhclient[9012]: DHCPACK from 192.168.1.1 (xid=0x12345678)
Apr 2 10:00:00 fgedu dhclient[9012]: bound to 192.168.1.10 — renewal in 43200 seconds.
Apr 2 10:00:00 fgedu chronyd[3456]: Selected source 192.168.1.1
Apr 2 10:00:00 fgedu chronyd[3456]: System clock wrong by -0.123456 seconds, adjusting
Apr 2 10:00:00 fgedu sshd[12345]: Accepted password for fgedu from 192.168.1.100 port 12345 ssh2
Apr 2 10:00:00 fgedu systemd[1]: Starting Session 1 of user fgedu.
Apr 2 10:00:00 fgedu systemd-logind[6789]: New session 1 of user fgedu.
Apr 2 10:00:00 fgedu systemd[1]: Started Session 1 of user fgedu.
Apr 2 10:00:00 fgedu systemd[1]: Starting Daily Cleanup of Temporary Directories…
Apr 2 10:00:00 fgedu systemd-tmpfiles[7890]: /var/tmp: 1 files removed.
Apr 2 10:00:00 fgedu systemd[1]: Started Daily Cleanup of Temporary Directories.

# 步骤5：查看安全日志
$ sudo tail -20 /var/log/secure
Apr 2 10:00:00 fgedu sshd[12345]: Accepted password for fgedu from 192.168.1.100 port 12345 ssh2
Apr 2 10:00:00 fgedu sshd[12345]: pam_unix(sshd:session): session opened for user fgedu by (uid=0)
Apr 2 10:00:00 fgedu systemd-logind[6789]: New session 1 of user fgedu.
Apr 2 10:00:00 fgedu sshd[12345]: pam_unix(sshd:session): session closed for user fgedu
Apr 2 10:00:00 fgedu sshd[12346]: Accepted publickey for fgedu from 192.168.1.100 port 12346 ssh2
Apr 2 10:00:00 fgedu sshd[12346]: pam_unix(sshd:session): session opened for user fgedu by (uid=0)
Apr 2 10:00:00 fgedu systemd-logind[6789]: New session 2 of user fgedu.
Apr 2 10:00:00 fgedu sshd[12346]: pam_unix(sshd:session): session closed for user fgedu

# 步骤6：配置自定义日志规则
$ sudo vi /etc/rsyslog.d/fgedu.conf
# 应用日志
local0.* /var/log/fgedu/app.log
local1.* /var/log/fgedu/database.log

# 步骤7：重启rsyslog服务
$ sudo systemctl restart rsyslog

# 步骤8：验证配置
$ sudo systemctl status rsyslog
● rsyslog.service – System Logging Service
Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2026-04-02 10:00:00 CST; 10s ago
Docs: man:rsyslogd(8)
https://www.rsyslog.com/doc/
Main PID: 1234 (rsyslogd)
Tasks: 3 (limit: 4915)
Memory: 3.5M
CGroup: /system.slice/rsyslog.service
└─1234 /usr/sbin/rsyslogd -n

# 步骤1：查看journald状态
$ sudo systemctl status systemd-journald
● systemd-journald.service – Journal Service
Loaded: loaded (/usr/lib/systemd/system/systemd-journald.service; static)
Active: active (running) since Wed 2026-04-02 10:00:00 CST; 10s ago
Docs: man:systemd-journald.service(8)
man:journald.conf(5)
Main PID: 1234 (systemd-journal)
Tasks: 1 (limit: 4915)
Memory: 8.5M
CGroup: /system.slice/systemd-journald.service
└─1234 /usr/lib/systemd/systemd-journald

# 步骤2：查看journald配置文件
$ cat /etc/systemd/journald.conf
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See journald.conf(5) for details.

[Journal]
#Storage=auto
#Compress=yes
#Seal=yes
#SplitMode=uid
#SyncIntervalSec=5m
#RateLimitIntervalSec=30s
#RateLimitBurst=1000
SystemMaxUse=512M
#SystemMaxFileSize=10M
#RuntimeMaxUse=128M
#RuntimeMaxFileSize=8M
#MaxRetentionSec=1month
#MaxFileSec=1month
#ForwardToSyslog=yes
#ForwardToKMsg=no
#ForwardToConsole=no
#ForwardToWall=yes
#TTYPath=/dev/tty10
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
#LineMax=48K

# 步骤3：修改journald配置
$ sudo vi /etc/systemd/journald.conf
# 修改以下配置
Storage=persistent
SystemMaxUse=1G
SystemMaxFileSize=100M
MaxRetentionSec=30day
ForwardToSyslog=yes

# 步骤4：重启journald服务
$ sudo systemctl restart systemd-journald

# 步骤5：查看journal日志
$ sudo journalctl -n 20
— Logs begin at Wed 2026-04-02 10:00:00 CST, end at Wed 2026-04-02 10:00:00 CST. —
Apr 02 10:00:00 fgedu systemd[1]: Starting System Logging Service…
Apr 02 10:00:00 fgedu rsyslogd[1234]: [origin software=”rsyslogd” swVersion=”8.2102.0″ x-pid=”1234″ x-info=”http://www.rsyslog.com”] start
Apr 02 10:00:00 fgedu systemd[1]: Started System Logging Service.
Apr 02 10:00:00 fgedu NetworkManager[5678]: [1234567890abcdef] device (eth0): state change: ip-config -> ip-check
Apr 02 10:00:00 fgedu NetworkManager[5678]: [1234567890abcdef] policy: set-ipv4-dns (eth0): 192.168.1.1 8.8.8.8
Apr 02 10:00:00 fgedu dhclient[9012]: DHCPREQUEST for 192.168.1.10 on eth0 to 255.255.255.255 port 67 (xid=0x12345678)
Apr 02 10:00:00 fgedu dhclient[9012]: DHCPACK from 192.168.1.1 (xid=0x12345678)
Apr 02 10:00:00 fgedu dhclient[9012]: bound to 192.168.1.10 — renewal in 43200 seconds.
Apr 02 10:00:00 fgedu chronyd[3456]: Selected source 192.168.1.1
Apr 02 10:00:00 fgedu chronyd[3456]: System clock wrong by -0.123456 seconds, adjusting
Apr 02 10:00:00 fgedu sshd[12345]: Accepted password for fgedu from 192.168.1.100 port 12345 ssh2
Apr 02 10:00:00 fgedu systemd-logind[6789]: New session 1 of user fgedu.
Apr 02 10:00:00 fgedu systemd[1]: Started Session 1 of user fgedu.

# 步骤6：查看特定服务的日志
$ sudo journalctl -u sshd -n 20
— Logs begin at Wed 2026-04-02 10:00:00 CST, end at Wed 2026-04-02 10:00:00 CST. —
Apr 02 10:00:00 fgedu systemd[1]: Starting OpenSSH server daemon…
Apr 02 10:00:00 fgedu sshd[12345]: Server listening on 0.0.0.0 port 2222.
Apr 02 10:00:00 fgedu sshd[12345]: Server listening on :: port 2222.
Apr 02 10:00:00 fgedu systemd[1]: Started OpenSSH server daemon.
Apr 02 10:00:00 fgedu sshd[12345]: Accepted password for fgedu from 192.168.1.100 port 12345 ssh2
Apr 02 10:00:00 fgedu sshd[12345]: pam_unix(sshd:session): session opened for user fgedu by (uid=0)
Apr 02 10:00:00 fgedu sshd[12345]: pam_unix(sshd:session): session closed for user fgedu

# 步骤7：查看错误日志
$ sudo journalctl -p err -n 20
— Logs begin at Wed 2026-04-02 10:00:00 CST, end at Wed 2026-04-02 10:00:00 CST. —
Apr 02 10:00:00 fgedu kernel: ACPI Error: Method parse/execution failed [\_SB_.PCI0.SBRG.EC0_._Q66] (AE_AML_PACKAGE_LIMIT)
Apr 02 10:00:00 fgedu kernel: ACPI Error: Method parse/execution failed [\_SB_.PCI0.SBRG.EC0_._Q67] (AE_AML_PACKAGE_LIMIT)
Apr 02 10:00:00 fgedu kernel: ACPI Error: Method parse/execution failed [\_SB_.PCI0.SBRG.EC0_._Q68] (AE_AML_PACKAGE_LIMIT)

# 步骤8：查看磁盘使用情况
$ sudo journalctl –disk-usage
Archived and active journals take up 123.4M in the file system.

# 步骤1：查看logrotate配置文件
$ cat /etc/logrotate.conf
# see “man logrotate” for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp and btmp — we’ll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
minsize 1M
rotate 1
}
/var/log/btmp {
missingok
monthly
create 0600 root utmp
rotate 1
}

# 步骤2：创建自定义日志轮转配置
$ sudo vi /etc/logrotate.d/fgedu
# 应用日志轮转
/var/log/fgedu/*.log {
daily
rotate 30
compress
delaycompress
missingok
notifempty
create 0644 fgedu fgedu
sharedscripts
postrotate
systemctl reload rsyslog > /dev/null 2>&1 || true
endscript
}

# 步骤3：测试日志轮转配置
$ sudo logrotate -d /etc/logrotate.conf
reading config file /etc/logrotate.conf
reading config file /etc/logrotate.d/fgedu
reading config file /etc/logrotate.d/httpd
…
rotating pattern: /var/log/fgedu/*.log after 1 days (30 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/fgedu/app.log
log does not need rotating
considering log /var/log/fgedu/database.log
log does not need rotating

# 步骤4：强制执行日志轮转
$ sudo logrotate -f /etc/logrotate.conf

# 步骤5：查看日志文件
$ ls -lh /var/log/fgedu/
total 20K
-rw-r–r– 1 fgedu fgedu 123 Apr 2 10:00 app.log
-rw-r–r– 1 fgedu fgedu 456 Apr 1 10:00 app.log-20260401
-rw-r–r– 1 fgedu fgedu 789 Apr 2 10:00 database.log
-rw-r–r– 1 fgedu fgedu 234 Apr 1 10:00 database.log-20260401

#!/bin/bash
# log_monitor.sh
# from:www.itpux.com.qq113257174.wx:itpux-com
# web: http://www.fgedu.net.cn

# 日志文件路径
LOG_FILES=(
“/var/log/messages”
“/var/log/secure”
“/var/log/fgedu/app.log”
)

# 关键词
KEYWORDS=(
“error”
“ERROR”
“fail”
“FAIL”
“warning”
“WARNING”
)

# 监控时间范围（分钟）
TIME_RANGE=5

# 当前时间
CURRENT_TIME=$(date +%s)

# 检查日志
for LOG_FILE in “${LOG_FILES[@]}”; do
if [ ! -f “$LOG_FILE” ]; then
continue
fi

echo “=== Checking $LOG_FILE ===”

for KEYWORD in “${KEYWORDS[@]}”; do
# 查找最近N分钟内的日志
LOG_LINES=$(grep -i “$KEYWORD” “$LOG_FILE” | while read -r line; do
LOG_TIME=$(echo “$line” | awk ‘{print $1″ “$2” “$3}’)
LOG_TIMESTAMP=$(date -d “$LOG_TIME” +%s 2>/dev/null)

if [ -n “$LOG_TIMESTAMP” ]; then
TIME_DIFF=$((CURRENT_TIME – LOG_TIMESTAMP))
TIME_DIFF_MIN=$((TIME_DIFF / 60))

if [ $TIME_DIFF_MIN -le $TIME_RANGE ]; then
echo “$line”
fi
fi
done)

if [ -n “$LOG_LINES” ]; then
echo “Found keyword ‘$KEYWORD’ in $LOG_FILE:”
echo “$LOG_LINES”
fi
done
done

# 检查journal日志
echo “=== Checking journal logs ===”
for KEYWORD in “${KEYWORDS[@]}”; do
LOG_LINES=$(sudo journalctl –since “$TIME_RANGE minutes ago” | grep -i “$KEYWORD”)

if [ -n “$LOG_LINES” ]; then
echo “Found keyword ‘$KEYWORD’ in journal:”
echo “$LOG_LINES”
fi
done

# 执行脚本
$ chmod +x log_monitor.sh
$ ./log_monitor.sh
=== Checking /var/log/messages ===
Found keyword ‘error’ in /var/log/messages:
Apr 2 10:00:00 fgedu kernel: ACPI Error: Method parse/execution failed [\_SB_.PCI0.SBRG.EC0_._Q66] (AE_AML_PACKAGE_LIMIT)
=== Checking /var/log/secure ===
=== Checking /var/log/fgedu/app.log ===
=== Checking journal logs ===
Found keyword ‘error’ in journal:
Apr 02 10:00:00 fgedu kernel: ACPI Error: Method parse/execution failed [\_SB_.PCI0.SBRG.EC0_._Q66] (AE_AML_PACKAGE_LIMIT)

#!/bin/bash
# log_analyze.sh
# from:www.itpux.com.qq113257174.wx:itpux-com
# web: http://www.fgedu.net.cn

# 日志文件
LOG_FILE=”/var/log/messages”

# 分析时间范围（小时）
HOURS=24

# 统计错误数量
echo “=== Error Statistics ===”
ERROR_COUNT=$(sudo grep -i “error” “$LOG_FILE” | wc -l)
echo “Total errors: $ERROR_COUNT”

# 统计警告数量
echo “”
echo “=== Warning Statistics ===”
WARNING_COUNT=$(sudo grep -i “warning” “$LOG_FILE” | wc -l)
echo “Total warnings: $WARNING_COUNT”

# 统计SSH登录次数
echo “”
echo “=== SSH Login Statistics ===”
SSH_LOGIN_COUNT=$(sudo grep “Accepted” /var/log/secure | wc -l)
echo “Total SSH logins: $SSH_LOGIN_COUNT”

# 统计失败的SSH登录次数
SSH_FAILED_COUNT=$(sudo grep “Failed” /var/log/secure | wc -l)
echo “Failed SSH logins: $SSH_FAILED_COUNT”

# 统计最活跃的IP
echo “”
echo “=== Top Active IPs ===”
sudo grep “Accepted” /var/log/secure | awk ‘{print $11}’ | sort | uniq -c | sort -rn | head -10

# 统计磁盘使用情况
echo “”
echo “=== Log Disk Usage ===”
sudo journalctl –disk-usage

# 执行脚本
$ chmod +x log_analyze.sh
$ ./log_analyze.sh
=== Error Statistics ===
Total errors: 123
=== Warning Statistics ===
Total warnings: 456
=== SSH Login Statistics ===
Total SSH logins: 78
Failed SSH logins: 12
=== Top Active IPs ===
45 192.168.1.100
20 192.168.1.101
13 192.168.1.102
=== Log Disk Usage ===
Archived and active journals take up 123.4M in the file system.