Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen der Seite angezeigt.

--- admin_grundlagen:logging [2018/07/05 14:23] – [Log Analyse Software] ingo_wichmann
+++ admin_grundlagen:logging [2026/04/22 14:07] (aktuell) – ingo_wichmann
@@ Zeile 7: / Zeile 7: @@
 Falls vorhanden:
   multitail /var/log/messages
-====== syslog ======
-siehe [[syslog]]
-====== logrotate ======
-siehe [[logrotate]]
 ====== logs auswerten ======
-Debian:
+===== Übersicht Logging-Stacks =====
-  logcheck
-openSuSE (13.1):
-  logdigest
-  logwatch
-CentOS (ab 5):
-  logwatch
-==== Log Analyse Software ====
-  * http://logstash.net/
-  * https://www.graylog.org/
-  * https://www.fluentd.org/
-  * http://loganalyzer.adiscon.com
-  * http://www.uberadmin.com/Projects/logtemplater/
-  * http://www.splunk.com ( proprietär )
-  * http://www.octopussy.pm
-(( Für Centos 6 benötigte Perl-Pakete:
-<file>
-perl-Apache-ASP
-perl-App-Info
-perl-Cache-Cache
-perl-Crypt-PasswdMD5
-perl-Date-Manip
-perl-JSON
-perl-List-MoreUtils
-perl-Locale-Maketext-Lexicon
-perl-Locale-Maketext-Simple
-perl-Mail-Sender
-perl-LDAP
-perl-Net-SCP
-perl-Net-Telnet
-perl-Net-XMPP
-perl-Proc-PID_File
-perl-Proc-ProcessTable
-perl-Readonly
-perl-Regexp-Assemble
-perl-Term-ProgressBar
-perl-Unix-Syslog
-perl-URI
-perl-version
-perl-XML-Simple
-</file>
-  xargs yum install -y
-while Schleife:
-  cat datei | while read line; do yum install -y $line; done
-))
-==== Log Analyse Konzepte ====
-  * Artificial Ignorance [[http://www.ranum.com/security/computer_security/papers/ai/index.html]]
-====== User Logging ======
-paket psacct installieren.
-Log aktivieren
-<code>
-touch acct.log
-accton acct.log
-</code>
-Log deaktivieren
-<code>
-accton
-</code>
+^                  ^  Collection ->^  Aggregation ->^ Storage ^ <- Analysis ^
+^                  |  logger ->|  [[syslog|rsyslog]] ->| /var/log, ... | <- grep / less / logcheck / … |
+^ journald         |     logger / systemd / … ->|| [[journald]] | <- journalctl |
+^ ELK              |  (File)Beat ->|  Logstash ->| Elasicsearch | <- Kibana |
+^ EFK              |  Fluentbit ->|    Fluentd ->| Elasicsearch | <- Kibana |
+^ Graylog          |    Graylog ->|    Graylog ->| Elasicsearch | <- Graylog |
+^ Victoria Logs    |      vlagent / Fluentbit ->|| Victoria Logs | <- Grafana |
+^ Loki             |         Alloy / Promtail ->|| Loki | <- Grafana |
-Logs auswerten
-<code>
-sa -a acct.log
-lastcomm -f acct.log --user nutzer14
-</code>