[root@www ~]# cat /var/log/secure
1 Mar 14 15:38:00 www atd[18701]: pam_unix(atd:session): session opened for 
  user root by (uid=0)
2 Mar 14 15:38:00 www atd[18701]: pam_unix(atd:session): session closed for
  user root
3 Mar 16 16:01:51 www su: pam_unix(su-l:auth): authentication failure; logn
  ame=vbird uid=500 euid=0 tty=pts/1 ruser=vbird rhost=  user=root
4 Mar 16 16:01:55 www su: pam_unix(su-l:session): session opened for user 
  root by vbird(uid=500)
5 Mar 16 16:02:22 www su: pam_unix(su-l:session): session closed for user root
  |--/ɶ---|-H-|-----AȻP-------|--T------>

AȦW[.=!]T		TOɦWθ˸mΥD
# UH mail oӪAȲͪ info ŬҡG
mail.info			/var/log/maillog_info
# o@满Gmail AȲͪj󵥩 info ŪTAO 
# /var/log/maillog_info ɮפNC

# Ӧ CentOS 5.x 
[root@www ~]# vim /etc/syslog.conf
  1 #kern.*                                              /dev/console
  2 *.info;mail.none;news.none;authpriv.none;cron.none   /var/log/messages
  3 authpriv.*                                           /var/log/secure
  4 mail.*                                              -/var/log/maillog
  5 cron.*                                               /var/log/cron
  6 *.emerg                                              *
  7 uucp,news.crit                                       /var/log/spooler
  8 local7.*                                             /var/log/boot.log
  9 news.=crit                                         /var/log/news/news.crit
 10 news.=err                                          /var/log/news/news.err
 11 news.notice                                        /var/log/news/news.notice

# 1. ]wnҭnإߪɮ׳]mI
[root@www ~]# vim /etc/syslog.conf
# Add by VBird 2009/04/08       <==AjաAۤvק諸ɭԥ[J@ǻ
*.info      /var/log/admin.log  <==ΪOoաI

# 2. sҰ syslog OI
[root@www ~]# /etc/init.d/syslog restart
[root@www ~]# ll /var/log/admin.log
-rw------- 1 root root 118 Apr  8 13:50 /var/log/admin.log
# @aIإߤFoӵnɥX{oI

[root@www ~]# chattr +a /var/log/messages
[root@www ~]# lsattr /var/log/messages
-----a------- /var/log/messages

[root@www ~]# chattr -a /var/log/messages

# 1. Server ݡGק syslogd Ұʳ]wɡAq`b /etc/sysconfig I
[root@www ~]# vim /etc/sysconfig/syslog
# 쩳Uo@G
SYSLOGD_OPTIONS="-m 0"
# 令UoˤlI
SYSLOGD_OPTIONS="-m 0 -r"

# 2. sҰʻP[ syslogd I
[root@www ~]# /etc/init.d/syslog restart
[root@www ~]# netstat -lunp | grep syslog
Proto Recv-Q Send-Q Local Address  Foreign Address State   PID/Program name
udp        0      0 0.0.0.0:514    0.0.0.0:*               13981/syslogd
# KKIAnɥDwg]woI²aI

[root@www ~]# vim /etc/syslog.conf
*.*       @192.168.1.100

[root@www ~]# vim /etc/logrotate.conf
# U]wO "logrotate w]]w" ApGӧOɮ׳]wFLѼơA
# hNHӧOɮ׳]wDAYɮרS]w쪺ѼƫhHoɮתew]ȡI

weekly    <==w]C§nɶi@ rotate u@
rotate 4  <==OdXӵnɩOHw]OOd|ӡI
create    <==ѩnɳQWA]إߤ@ӷs~xsNI
#compress <==QʪnɬO_ݭnYHpGnɤӤjhiҼ{ѼƱҰ

include /etc/logrotate.d
# N /etc/logrotate.d/ oӥؿҦɮ׳ŪiӰ rotate u@I

/var/log/wtmp {       <==Ȱw /var/log/wtmp ҳ]wѼ
    monthly           <==CӤ@ANCgI
    minsize 1M        <==ɮ׮eq@wnWL 1M ~i rotate (LɶѼ)
    create 0664 root utmp <==wsɮתvPݱb/s
    rotate 1          <==ȫOd@ӡAYȦ wtmp.1 OdӤwC
}
# o wtmp iOnJ̻Ptέs}ɪɶPӷDεnJɶC
# ѩ㦳 minsize ѼơA]oCӤ@w|i@Inɮ׮eqC
# ѩȫOd@ӵnɦӤwANܥiHNL令 rotate 5 aI

nɪ|ɦW ... {
	ӧOѼƳ]wȡAp monthly, compress 
}

[root@www ~]# vi /etc/logrotate.d/syslog
/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler \
/var/log/boot.log /var/log/cron {
  sharedscripts
  postrotate
    /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
  endscript
}

[root@www ~]# vi /etc/logrotate.d/syslog
/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler \
/var/log/boot.log /var/log/cron {
  sharedscripts
  prerotate
    /usr/bin/chattr -a /var/log/messages
  endscript
  sharedscripts
  postrotate
    /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
    /usr/bin/chattr +a /var/log/messages
  endscript
}

[root@www ~]# logrotate [-vf] logfile
ﶵPѼơG
-v  GҰܼҦA| logrotate B@L{I
-f  G׬O_ŦX]wɪơAjCӵnɳi rotate ʧ@I

dҤ@G@ logrotate ݬݾӬy{H
[root@www ~]# logrotate -v /etc/logrotate.conf
reading config file /etc/logrotate.conf <==ŪDn]w
including /etc/logrotate.d              <==Is~]w
reading config file acpid               <==NO~]wڡI
....(ٲ)....
Handling 21 logs                        <==@ 21 ӵnɳQO
....(ٲ)....
rotating pattern: /var/log/messages /var/log/secure /var/log/maillog \
/var/log/spooler /var/log/boot.log /var/log/cron  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/messages       <==}lBz messages
  log does not need rotating            <==]ɶAݭnʡI
....(Uٲ)....

dҤGGji logrotate ʧ@
[root@www ~]# logrotate -vf /etc/logrotate.conf
....(eٲ)....
rotating log /var/log/messages, log->rotateCount is 4
renaming /var/log/messages.4 to /var/log/messages.5 (rotatecount 4, logstart 1, i 4),
renaming /var/log/messages.3 to /var/log/messages.4 (rotatecount 4, logstart 1, i 3),
renaming /var/log/messages.2 to /var/log/messages.3 (rotatecount 4, logstart 1, i 2),
renaming /var/log/messages.1 to /var/log/messages.2 (rotatecount 4, logstart 1, i 1),
renaming /var/log/messages.0 to /var/log/messages.1 (rotatecount 4, logstart 1, i 0),
old log /var/log/messages.0 does not exist
....(Uٲ)....
# ݨ_H rotate ʧ@NOoˤ@B@Bi檺

[root@www ~]# ll /var/log/messages*; lsattr /var/log/messages
-rw------- 1 root root    63 Apr  8 15:19 /var/log/messages
-rw------- 1 root root   670 Apr  8 14:22 /var/log/messages.1
-rw------- 1 root root 24984 Apr  1 19:26 /var/log/messages.2
-rw------- 1 root root  1911 Mar 28 11:32 /var/log/messages.3
-rw------- 1 root root 25193 Mar 22 04:02 /var/log/messages.4
-----a------- /var/log/messages <==Dʥ[J a ݩoI

# 1. إ +a oݩʰڡI
[root@www ~]# chattr +a /var/log/admin.log
[root@www ~]# lsattr /var/log/admin.log
-----a------- /var/log/admin.log
[root@www ~]# mv /var/log/admin.log /var/log/admin.log.1
mv: cannot move `/var/log/admin.log' to `/var/log/admin.log.1': 
Operation not permitted
# o̽TwF[J a ݩʡIҥH root LkʦnɡI

# 2. }lإ logrotate ]wɡAW[@ɮצb /etc/logrotate.d NFI
[root@www ~]# vi /etc/logrotate.d/admin
# This configuration is from VBird 2009/04/08
/var/log/admin.log {
        monthly   <==CӤi@
        size=10M  <==ɮ׮eqj 10M h}lBm
        rotate 5  <==OdӡI
        compress  <==iYu@I
        sharedscripts
        prerotate
                /usr/bin/chattr -a /var/log/admin.log
        endscript
        sharedscripts
        postrotate
                /usr/bin/killall -HUP syslogd
                /usr/bin/chattr +a /var/log/admin.log
        endscript
}

# 3. դ@U logrotate \઺TܡG
[root@www ~]# logrotate -v /etc/logrotate.conf
....(eٲ)....
rotating pattern: /var/log/admin.log  10485760 bytes (5 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/admin.log
  log does not need rotating
not running prerotate script, since no logs will be rotated
not running postrotate script, since no logs were rotated
....(Uٲ)....
# ]٤@ӤAɮפ]Sj 10MAҥHݶiI

# 4. դ@Uj logrotate P\઺TܡG
[root@www ~]# logrotate -vf /etc/logrotate.d/admin
reading config file /etc/logrotate.d/admin
reading config info for /var/log/admin.log

Handling 1 logs

rotating pattern: /var/log/admin.log  forced from command line (5 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/admin.log
  log needs rotating
rotating log /var/log/admin.log, log->rotateCount is 5
renaming /var/log/admin.log.5.gz to /var/log/admin.log.6.gz (rotatecount 5, logstart 1, i 5),
old log /var/log/admin.log.5.gz does not exist
renaming /var/log/admin.log.4.gz to /var/log/admin.log.5.gz (rotatecount 5, logstart 1, i 4),
old log /var/log/admin.log.4.gz does not exist
renaming /var/log/admin.log.3.gz to /var/log/admin.log.4.gz (rotatecount 5, logstart 1, i 3),
old log /var/log/admin.log.3.gz does not exist
renaming /var/log/admin.log.2.gz to /var/log/admin.log.3.gz (rotatecount 5, logstart 1, i 2),
old log /var/log/admin.log.2.gz does not exist
renaming /var/log/admin.log.1.gz to /var/log/admin.log.2.gz (rotatecount 5, logstart 1, i 1),
old log /var/log/admin.log.1.gz does not exist
renaming /var/log/admin.log.0.gz to /var/log/admin.log.1.gz (rotatecount 5, logstart 1, i 0),
old log /var/log/admin.log.0.gz does not exist
log /var/log/admin.log.6.gz doesn't exist -- won't try to dispose of it
running prerotate script
renaming /var/log/admin.log to /var/log/admin.log.1
running postrotate script
compressing log with: /bin/gzip


[root@www ~]# lsattr /var/log/admin.log*
-----a------- /var/log/admin.log
------------- /var/log/admin.log.1.gz  <==YLI

[root@www ~]# mail
Mail version 8.1 6/6/93.  Type ? for help.
"/var/spool/mail/root": 433 messages 433 new
>N  1 logwatch@www.vbird.t  Fri Sep  5 11:42  43/1542  "Logwatch for www.vbird.tsai (Linux)"
 N  2 logwatch@www.vbird.t  Sat Sep  6 15:34  92/2709  "Logwatch for www.vbird.tsai (Linux)"
 N  3 logwatch@www.vbird.t  Mon Sep  8 15:26  43/1542  "Logwatch for www.vbird.tsai (Linux)"
....(ٲ)....
 N431 logwatch@www.vbird.t  Wed Apr  8 04:02  53/1772  "Logwatch for www.vbird.tsai (Linux)"
& 431
Message 431:
From root@www.vbird.tsai  Wed Apr  8 04:02:05 2009
Date: Wed, 8 Apr 2009 04:02:05 +0800
To: root@www.vbird.tsai
From: logwatch@www.vbird.tsai
Subject: Logwatch for www.vbird.tsai (Linux)
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="iso-8859-1"

# |RPRI
 ################### Logwatch 7.3 (03/24/06) ####################
        Processing Initiated: Wed Apr  8 04:02:05 2009
        Date Range Processed: yesterday
                              ( 2009-Apr-07 )
                              Period is day.
      Detail Level of Output: 0
              Type of Output: unformatted
           Logfiles for Host: www.vbird.tsai
  ##################################################################

# UhO̾ڦUتAȨӶiURIOnJ̪ ssh AȤR
 --------------------- SSHD Begin ------------------------

 Users logging in through sshd:
    root:
       192.168.100.101: 1 time
       192.168.100.254: 1 time

 ---------------------- SSHD End -------------------------

# ϺЮeqRIiHקKAtΨϥιLqϺСAɭPtΤíDI
 --------------------- Disk Space Begin ------------------------

 Filesystem            Size  Used Avail Use% Mounted on
 /dev/hda2             9.5G  3.8G  5.3G  42% /
 /dev/hda3             4.8G  1.1G  3.5G  23% /home
 /dev/hda1              99M   21M   73M  23% /boot

 ---------------------- Disk Space End -------------------------
 ###################### Logwatch End #########################

[root@www ~]# mkdir /usr/local/virus
[root@www ~]# tar -zxvf logfile-0.1-4-2.tgz -C /usr/local/virus
[root@www ~]# cd /usr/local/virus/logfile
[root@www logfile]# vi logfile.sh
email="root@localhost" <==jb 93 楪kAжJA email A_hOdw]
basedir="/usr/local/virus/logfile" <==Odw]ȡADAؿPPI

[root@www logfile]# sh logfile.sh
# }lդRtΪnɡA̾ڧAnɤjpARɶTwI

[root@www logfile]# vi /etc/crontab
10 0 * * * root /usr/local/virus/logfile/logfile.sh
# W[o@ItΦbCѪۤvinɤRI

[root@www logfile]# mail
# ۤvXGAӵGXIUoˡG

# i{ŧiIA]iHbUs@ǿ~^I
##########################################################
wϥΥ{Ӭdzn
{ثeG Version 0.1-4-2
{̫sG 2006-09-22
YbztΤo{{D, wPpI
 http://vbird.org.cn
D^G http://phorum.vbird.org/viewtopic.php?t=3425
##########################################################

# ݬݧAwP@~tΪpAרO partition ϥζqݭnHɪ`NI
=============== tηJ =================================
֤ߪ  : Linux version 2.6.18-92.el5 (mockbuild@builder16.centos.org)
CPU T  : Intel(R) Celeron(TM) CPU
          : 1200.062 MHz
DW  : www.vbird.tsai
έp  : 2009/April/08 17:00:59 ( Wednesday )
R: Apr  8
w}: 7 days, 22:46,
ثeD partitions
       Filesystem            Size  Used Avail Use% Mounted on
       /dev/hda2             9.5G  3.8G  5.3G  42% /
       /dev/hda3             4.8G  1.1G  3.5G  23% /home
       /dev/hda1              99M   21M   73M  23% /boot
       tmpfs                 363M     0  363M   0% /dev/shm

# oӵ{|Nw internet Pťf}ܡI
================= Ports RT =======================
DҥΪ port P process ownerG
ȹ糧} ports (PID|owner|command)
       tcp 25|(root)|sendmail: accepting connections
       tcp 631|(root)|cupsd
       tcp 2207|(root)|python ./hpssd.py
       tcp 2208|(root)|./hpiod
~} ports (PID|owner|command)
       tcp 22|(root)|/usr/sbin/sshd
       tcp 111|(rpc)|portmap
       tcp 737|(root)|rpc.statd
       udp 111|(rpc)|portmap
       udp 514|(root)|syslogd -m 0 -r
       udp 631|(root)|cupsd
       udp 731|(root)|rpc.statd
       udp 734|(root)|rpc.statd
       udp 5353|(avahi)|avahi-daemon: running [www.local]
       udp 32768|(avahi)|avahi-daemon: running [www.local]
       udp 32769|(avahi)|avahi-daemon: running [www.local]

# HUw靈ҰʪAȭӧOiRI
================= SSH nɸTJ =======================
Sϥ SSH 


================= Sednamil nɸTJ ==================
zDi SASL {Ҫ\

S sendmail T


================= nɸTJ =======================
1. nnO ( Secure file )
   GwgF pop3 TI
Apr  8 15:46:22 www su: session opened for user vbird by root(uid=0)
Apr  8 15:47:02 www su: session closed for user vbird

2. ϥ last oӫOXG

wtmp begins Wed Apr  8 15:19:47 2009

3. NSn /var/log/messages CX@@I
   wg crond P snmpd T
Apr  8 15:19:47 www syslogd 1.4.1: restart (remote reception).
Apr  8 15:34:25 www syslogd 1.4.1: restart (remote reception).