如何配置Linux日志记录策略

sudo apt-get install rsyslog  # Debian/Ubuntu
sudo yum install rsyslog      # CentOS/RHEL

<code># 将所有内核消息记录到/var/log/kern.log
kern.* /var/log/kern.log

# 将所有身份验证消息记录到/var/log/authpriv.log
authpriv.* /var/log/authpriv.log

# 将所有cron消息记录到/var/log/cron.log
cron.* /var/log/cron.log

# 将所有本地系统消息记录到/var/log/messages
*.* /var/log/messages

# 将邮件相关消息记录到/var/log/mail.log
mail.* -/var/log/mail.log</code>

sudo systemctl restart rsyslog

# 查看所有日志
journalctl

# 查看特定服务的日志 (例如sshd)
journalctl -u sshd

# 查看特定时间段的日志 (例如2023年4月1日至30日)
journalctl --since "2023-04-01" --until "2023-04-30"

# 实时查看日志
journalctl -f

<code>[Journal]
SystemMaxUse=500M
SystemKeepFree=100M
SystemMaxFileSize=50M
SystemMaxFiles=5</code>

sudo apt-get install logrotate  # Debian/Ubuntu
sudo yum install logrotate      # CentOS/RHEL

<code>/var/log/syslog {
    daily
    missingok
    rotate 7
    compress
    delaycompress
    notifempty
    create 0640 root adm
}</code>

sudo apt-get install auditd audispd-plugins  # Debian/Ubuntu
sudo yum install audit                # CentOS/RHEL

<code>log_format = RAW
log_target = SYSLOG
name_format = host=hostname comm=program pid=pid user=uid auid=uid</code>

sudo auditctl -a exit,always -F arch=b64 -S execve -k processes
sudo auditctl -a exit,always -F arch=b32 -S execve -k processes

sudo apt-get install fail2ban  # Debian/Ubuntu
sudo yum install fail2ban      # CentOS/RHEL

<code>[DEFAULT]
bantime = 600
findtime = 600
maxretry = 3

[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log</code>

sudo systemctl restart fail2ban