目录
- 23.1. log
-
- 23.1.1. logwatch
- 23.1.2. logcheck : Analyzes log files and sends noticeable events as email
- 23.1.3. nulog
- 23.2. Web
-
- 23.2.1. Apache Log
-
- 23.2.1.1. 刪除日志
- 23.2.1.2. 统计爬虫
- 23.2.1.3. 统计浏览器
- 23.2.1.4. IP 统计
- 23.2.1.5. 统计域名
- 23.2.1.6. HTTP Status
- 23.2.1.7. URL 统计
- 23.2.1.8. 文件流量统计
- 23.2.1.9. URL访问量统计
- 23.2.1.10. 脚本运行速度
- 23.2.1.11. IP, URL 抽取
- 23.2.2. awstats
-
- 23.2.2.1. 语言
- 23.2.2.2. 输出HTML文档
- 23.2.2.3. 多站点配置
- 23.2.2.4. 合并日志
- 23.2.2.5. Flush history file on disk (unique url reach flush limit of 5000) 优化
- 23.2.2.6. JAWStats
- 23.2.3. webalizer
-
- 23.2.3.1. 手工生成
- 23.2.3.2. 批量处理历史数据
- 23.2.3.3. crontab
- 23.2.4. Sarg - Squid Analysis Report Generator
- 23.2.5. goaccess - Fast web log analyzer and interactive viewer.
- 23.3. Tomcat
-
- 23.3.1. 截取 0-3 点区间的日志
- 23.3.2. 监控Redis
- 23.4. Mail
-
- 23.4.1. pflogsumm.pl - Produce Postfix MTA logfile summary
- 23.5. OpenSSH 日志 /var/log/secure
-
- 23.5.1. 查看登陆用户
- 23.6. rinetd.log
- 23.7. php-syslog-ng
- 23.8. Log Analyzer
- 23.9. Splunk
- 23.10. Octopussy
- 23.11. eventlog-to-syslog
- 23.12. Apache Flume
-
- 23.12.1. 安装 Apache flume
- 23.12.2. 基本配置
- 23.12.3. 配置 MySQL 存储日志
- 23.12.4. 配置 HDFS 存储日志
23.1. log
23.1.1. logwatch
logwatch - log analyser with nice output written in Perl
http://www.logwatch.org/
过程 23.1. logwatch 安装步骤:
-
Install
Ubuntu 7.10
netkiller@shenzhen:/etc/webmin$ apt-cache search logwatch fwlogwatch - Firewall log analyzer logwatch - log analyser with nice output written in Perl
apt-get install
# apt-get install logwatch
the logwatch has been installed, it should create a file in '/etc/cron.daily/00logwatch'.
-
config
$ sudo cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/logwatch.conf $ sudo mkdir /var/cache/logwatch $ sudo vim /etc/logwatch/conf/logwatch.conf
mail to
# Default person to mail reports to. Can be a local account or a # complete email address. MailTo = root, openunix@163.com, other@example.com
To change detail level for the report
# The default detail level for the report. # This can either be Low, Med, High or a number. # Low = 0 # Med = 5 # High = 10 Detail = High
Crontab
netkiller@shenzhen:~$ cat /etc/cron.daily/00logwatch #!/bin/bash #Check if removed-but-not-purged test -x /usr/share/logwatch/scripts/logwatch.pl || exit 0 #execute /usr/sbin/logwatch
-
The logwatch is command, you can run it.
logwatch --print单独查看某个服务，比如 SSH 登录信息
logwatch --service sshd --print
23.1.2. logcheck : Analyzes log files and sends noticeable events as email
# yum search logcheck | grep logcheck Repodata is over 2 weeks old. Install yum-cron? Or run: yum makecache fast ============================ N/S matched: logcheck ============================= logcheck.noarch : Analyzes log files and sends noticeable events as email
安装 logcheck
# yum install -y logcheck
查看 logchek 包所含文件
[root@173 ~]# rpm -ql logcheck /etc/cron.d/logcheck /etc/logcheck /etc/logcheck/cracking.d /etc/logcheck/cracking.d/kernel /etc/logcheck/cracking.d/rlogind /etc/logcheck/cracking.d/rsh /etc/logcheck/cracking.d/smartd /etc/logcheck/cracking.d/tftpd /etc/logcheck/cracking.d/uucico /etc/logcheck/ignore.d.paranoid /etc/logcheck/ignore.d.paranoid/bind /etc/logcheck/ignore.d.paranoid/cron /etc/logcheck/ignore.d.paranoid/incron /etc/logcheck/ignore.d.paranoid/logcheck /etc/logcheck/ignore.d.paranoid/postfix /etc/logcheck/ignore.d.paranoid/ppp /etc/logcheck/ignore.d.paranoid/pureftp /etc/logcheck/ignore.d.paranoid/qpopper /etc/logcheck/ignore.d.paranoid/squid /etc/logcheck/ignore.d.paranoid/ssh /etc/logcheck/ignore.d.paranoid/stunnel /etc/logcheck/ignore.d.paranoid/sysklogd /etc/logcheck/ignore.d.paranoid/telnetd /etc/logcheck/ignore.d.paranoid/tripwire /etc/logcheck/ignore.d.paranoid/usb /etc/logcheck/ignore.d.server /etc/logcheck/ignore.d.server/NetworkManager /etc/logcheck/ignore.d.server/acpid /etc/logcheck/ignore.d.server/amandad /etc/logcheck/ignore.d.server/amavisd-new /etc/logcheck/ignore.d.server/anacron /etc/logcheck/ignore.d.server/anon-proxy /etc/logcheck/ignore.d.server/apache /etc/logcheck/ignore.d.server/apcupsd /etc/logcheck/ignore.d.server/arpwatch /etc/logcheck/ignore.d.server/asterisk /etc/logcheck/ignore.d.server/automount /etc/logcheck/ignore.d.server/bind /etc/logcheck/ignore.d.server/bluez-utils /etc/logcheck/ignore.d.server/courier /etc/logcheck/ignore.d.server/cpqarrayd /etc/logcheck/ignore.d.server/cpufreqd /etc/logcheck/ignore.d.server/cron /etc/logcheck/ignore.d.server/cron-apt /etc/logcheck/ignore.d.server/cups-lpd /etc/logcheck/ignore.d.server/cvs-pserver /etc/logcheck/ignore.d.server/cvsd /etc/logcheck/ignore.d.server/cyrus /etc/logcheck/ignore.d.server/dbus /etc/logcheck/ignore.d.server/dcc /etc/logcheck/ignore.d.server/ddclient /etc/logcheck/ignore.d.server/dhclient /etc/logcheck/ignore.d.server/dhcp /etc/logcheck/ignore.d.server/dictd /etc/logcheck/ignore.d.server/dkfilter /etc/logcheck/ignore.d.server/dkim-filter /etc/logcheck/ignore.d.server/dnsmasq /etc/logcheck/ignore.d.server/dovecot /etc/logcheck/ignore.d.server/dropbear /etc/logcheck/ignore.d.server/dspam /etc/logcheck/ignore.d.server/epmd /etc/logcheck/ignore.d.server/exim4 /etc/logcheck/ignore.d.server/fcron /etc/logcheck/ignore.d.server/ftpd /etc/logcheck/ignore.d.server/git-daemon /etc/logcheck/ignore.d.server/gnu-imap4d /etc/logcheck/ignore.d.server/gps /etc/logcheck/ignore.d.server/grinch /etc/logcheck/ignore.d.server/horde3 /etc/logcheck/ignore.d.server/hplip /etc/logcheck/ignore.d.server/hylafax /etc/logcheck/ignore.d.server/ikiwiki /etc/logcheck/ignore.d.server/imap /etc/logcheck/ignore.d.server/imapproxy /etc/logcheck/ignore.d.server/imp /etc/logcheck/ignore.d.server/imp4 /etc/logcheck/ignore.d.server/innd /etc/logcheck/ignore.d.server/ipppd /etc/logcheck/ignore.d.server/isdnlog /etc/logcheck/ignore.d.server/isdnutils /etc/logcheck/ignore.d.server/jabberd /etc/logcheck/ignore.d.server/kernel /etc/logcheck/ignore.d.server/klogind /etc/logcheck/ignore.d.server/krb5-kdc /etc/logcheck/ignore.d.server/libpam-krb5 /etc/logcheck/ignore.d.server/libpam-mount /etc/logcheck/ignore.d.server/logcheck /etc/logcheck/ignore.d.server/login /etc/logcheck/ignore.d.server/maradns /etc/logcheck/ignore.d.server/mldonkey-server /etc/logcheck/ignore.d.server/mon /etc/logcheck/ignore.d.server/mountd /etc/logcheck/ignore.d.server/nagios /etc/logcheck/ignore.d.server/netconsole /etc/logcheck/ignore.d.server/nfs /etc/logcheck/ignore.d.server/nntpcache /etc/logcheck/ignore.d.server/nscd /etc/logcheck/ignore.d.server/nslcd /etc/logcheck/ignore.d.server/openvpn /etc/logcheck/ignore.d.server/otrs /etc/logcheck/ignore.d.server/passwd /etc/logcheck/ignore.d.server/pdns /etc/logcheck/ignore.d.server/perdition /etc/logcheck/ignore.d.server/policyd /etc/logcheck/ignore.d.server/popa3d /etc/logcheck/ignore.d.server/postfix /etc/logcheck/ignore.d.server/postfix-policyd /etc/logcheck/ignore.d.server/ppp /etc/logcheck/ignore.d.server/pptpd /etc/logcheck/ignore.d.server/procmail /etc/logcheck/ignore.d.server/proftpd /etc/logcheck/ignore.d.server/puppetd /etc/logcheck/ignore.d.server/pure-ftpd /etc/logcheck/ignore.d.server/pureftp /etc/logcheck/ignore.d.server/qpopper /etc/logcheck/ignore.d.server/rbldnsd /etc/logcheck/ignore.d.server/rpc_statd /etc/logcheck/ignore.d.server/rsnapshot /etc/logcheck/ignore.d.server/rsync /etc/logcheck/ignore.d.server/sa-exim /etc/logcheck/ignore.d.server/samba /etc/logcheck/ignore.d.server/saned /etc/logcheck/ignore.d.server/sasl2-bin /etc/logcheck/ignore.d.server/saslauthd /etc/logcheck/ignore.d.server/schroot /etc/logcheck/ignore.d.server/scponly /etc/logcheck/ignore.d.server/slapd /etc/logcheck/ignore.d.server/smartd /etc/logcheck/ignore.d.server/smbd_audit /etc/logcheck/ignore.d.server/smokeping /etc/logcheck/ignore.d.server/snmpd /etc/logcheck/ignore.d.server/snort /etc/logcheck/ignore.d.server/spamc /etc/logcheck/ignore.d.server/spamd /etc/logcheck/ignore.d.server/squid /etc/logcheck/ignore.d.server/ssh /etc/logcheck/ignore.d.server/stunnel /etc/logcheck/ignore.d.server/su /etc/logcheck/ignore.d.server/sudo /etc/logcheck/ignore.d.server/sympa /etc/logcheck/ignore.d.server/syslogd /etc/logcheck/ignore.d.server/systemd /etc/logcheck/ignore.d.server/teapop /etc/logcheck/ignore.d.server/telnetd /etc/logcheck/ignore.d.server/tftpd /etc/logcheck/ignore.d.server/thy /etc/logcheck/ignore.d.server/ucd-snmp /etc/logcheck/ignore.d.server/upsd /etc/logcheck/ignore.d.server/uptimed /etc/logcheck/ignore.d.server/userv /etc/logcheck/ignore.d.server/vsftpd /etc/logcheck/ignore.d.server/watchdog /etc/logcheck/ignore.d.server/wu-ftpd /etc/logcheck/ignore.d.server/xinetd /etc/logcheck/ignore.d.workstation /etc/logcheck/ignore.d.workstation/automount /etc/logcheck/ignore.d.workstation/bind /etc/logcheck/ignore.d.workstation/bluetooth-alsa /etc/logcheck/ignore.d.workstation/bluez-utils /etc/logcheck/ignore.d.workstation/bonobo /etc/logcheck/ignore.d.workstation/dhcpcd /etc/logcheck/ignore.d.workstation/francine /etc/logcheck/ignore.d.workstation/gconf /etc/logcheck/ignore.d.workstation/gdm /etc/logcheck/ignore.d.workstation/hald /etc/logcheck/ignore.d.workstation/hcid /etc/logcheck/ignore.d.workstation/ifplugd /etc/logcheck/ignore.d.workstation/ippl /etc/logcheck/ignore.d.workstation/kdm /etc/logcheck/ignore.d.workstation/kernel /etc/logcheck/ignore.d.workstation/laptop-mode-tools /etc/logcheck/ignore.d.workstation/libmtp-runtime /etc/logcheck/ignore.d.workstation/libpam-gnome-keyring /etc/logcheck/ignore.d.workstation/logcheck /etc/logcheck/ignore.d.workstation/login /etc/logcheck/ignore.d.workstation/net-acct /etc/logcheck/ignore.d.workstation/nntpcache /etc/logcheck/ignore.d.workstation/polypaudio /etc/logcheck/ignore.d.workstation/postfix /etc/logcheck/ignore.d.workstation/ppp /etc/logcheck/ignore.d.workstation/proftpd /etc/logcheck/ignore.d.workstation/pump /etc/logcheck/ignore.d.workstation/sendfile /etc/logcheck/ignore.d.workstation/slim /etc/logcheck/ignore.d.workstation/squid /etc/logcheck/ignore.d.workstation/udev /etc/logcheck/ignore.d.workstation/wdm /etc/logcheck/ignore.d.workstation/winbind /etc/logcheck/ignore.d.workstation/wpasupplicant /etc/logcheck/ignore.d.workstation/xdm /etc/logcheck/ignore.d.workstation/xlockmore /etc/logcheck/logcheck.conf /etc/logcheck/logcheck.logfiles /etc/logcheck/violations.d /etc/logcheck/violations.d/kernel /etc/logcheck/violations.d/smartd /etc/logcheck/violations.d/su /etc/logcheck/violations.d/sudo /etc/logcheck/violations.ignore.d /etc/logcheck/violations.ignore.d/logcheck-su /etc/logcheck/violations.ignore.d/logcheck-sudo /etc/tmpfiles.d/logcheck.conf /usr/bin/logcheck-test /usr/sbin/logcheck /usr/sbin/logtail /usr/sbin/logtail2 /usr/share/doc/logcheck-1.3.15 /usr/share/doc/logcheck-1.3.15/LICENSE /usr/share/doc/logcheck-1.3.15/README-psionic /usr/share/doc/logcheck-1.3.15/README.Maintainer /usr/share/doc/logcheck-1.3.15/README.how.to.interpret /usr/share/doc/logcheck-1.3.15/README.keywords /usr/share/doc/logcheck-1.3.15/README.logcheck /usr/share/doc/logcheck-1.3.15/README.logcheck-database /usr/share/doc/logcheck-1.3.15/README.logtail /usr/share/doc/logcheck-1.3.15/logcheck-test.1 /usr/share/doc/logcheck-1.3.15/logcheck.sgml /usr/share/doc/logcheck-1.3.15/logtail.8 /usr/share/doc/logcheck-1.3.15/logtail2.8 /usr/share/doc/logcheck-1.3.15/tools /usr/share/doc/logcheck-1.3.15/tools/log-summary-ssh /usr/share/logtail /usr/share/logtail/detectrotate /usr/share/logtail/detectrotate/10-savelog.dtr /usr/share/logtail/detectrotate/20-logrotate.dtr /usr/share/logtail/detectrotate/30-logrotate-dateext.dtr /usr/share/man/man1/logcheck-test.1.gz /usr/share/man/man8/logcheck.8.gz /usr/share/man/man8/logtail.8.gz /usr/share/man/man8/logtail2.8.gz /var/lib/logcheck /var/lock/logcheck
23.1.3. nulog
例 23.1. config.php
原文出处：Netkiller 系列 手札
本文作者：陈景峯
转载请与作者联系，同时请务必标明文章原始出处和作者信息及本声明。
