The Linux operating system has a built-in logging facility. The aim of logging is to log system events, in addition to application events and user events.
Why Log Events?
Having a log of events is very important for the system administrator, in order to troubleshoot errors, system faults and to understand activities performed by a user i.e. last login.
View Log Events
Log events are recorded in /var/logs
If you navigate to this folder using the CLI and ‘ls‘ you will see a number of log files.
messages – This is the generic log file for recording startup events, application events
dmesg – This records kernel messages, including boot up messages, hardware information
boot.log – This records the information that you see when Linux boots
cron – Lists cron job events
To view the above log files simply enter ‘more messages‘ to view the messages log.
Special note: dmesg is also a command i.e. typing ‘dmesg | grep -i usb‘ will return a selected list of event messages containing the keyword USB.
To search the messages for ‘usb’ try the following command:
tail -f messages | grep ‘usb’
What Next?
Familiarization with the following commands will help you navigate around the various log files:
less, more, cat, tail – use for viewing files at the CLI
grep – a very powerful utility that can be used for pattern matching/text searching
logger – enables the use to log events via the CLI
Way Forward
The above covers the basic principles of Linux logging. These log files underpin IT security monitoring capabilities and used on an enterprise scale. The next articles will cover the use of ‘syslog’ that can be used to harvest log files for intrusion detection.
