[ Pobierz całość w formacie PDF ]
.The administrator should checksome logs on a daily basis, such as system and kernel logs.Other logs, such as bootmessages or login information, can be examined with less frequency.Linux log files are located in the /var/log directory.This directory contains severallog files for both system functions and applications.The following list includessome of the more important logs that should be monitored on a regular basis.&' /var/log/messages: syslog is configured to write kernel and system errorsin this log.This log should be checked daily for any warning messages.&' /var/log/wtmp: This log file keeps track of the time and date of user logins.This file can grow very quickly.The lastcommand uses this log to show alist of users who have logged-in.This is helpful in tracking when certain usershave logged in to the system at times that may indicate suspicious activity.&' /var/log/dmesg: This log file contains the results of your last system boot.Itdisplays the various kernel messages that appeared on the monitor during theboot phase.This log file is helpful when debugging boot time problems. 194881-6 ch13.F 11/12/01 8:31 AM Page 420Part V &' Maintaining the Linux System420Know the different types of log files and what information they contain.Because many of these log files can be very large, you may want to pipe it throughthe morecommand, or use grepto find only the keywords in the log file that youare looking for.For example, the following command searches the messages file forany reference to mail: cat /var/log/messages | grep mailSometimes you may want to monitor a log file in real time in order to see the resultsof an application or process that you are testing.For this, you can use the tailcommand with the follow argument:tail f /var/log/messagesThis command shows the messages file on the monitor screen.As entries are addedto the log, they are immediately displayed.Most log files are not set to roll over automatically, and you will find that these logscan grow very quickly, thus eating valuable disk space.Therefore, it s a good idea touse some sort of scheduling program, such as cron, to automate rolling over log files.The easiest way to automate file rollover is to create a simple batch file thatrenames the current log file so that the system can start writing a new log file withthe original name.Most administrators name the files by date, so they can easilytrack the files when looking for historical data.Enter a log rotation into your cronschedule to run daily or weekly as required.Unattended log files can quickly fill your disk file systems.Pay close attention totheir sizes, or use the cron process to automate log retention.Maintaining Documentation5.9 Document work performed on a systemLinux system administrators often overlook the task of documenting their systems.This can be a major oversight, because without proper documentation, you won thave immediate access to the information that you need to restore a system in theevent of a system crash or hardware failure. 194881-6 ch13.F 11/12/01 8:31 AM Page 421Chapter 13 &' Process Management421You should keep accurate records of all the hardware and software on your system.Here are some of the more important items that you should be tracking:&' Hardware" Vendor serial and model number" Processor speed and type, and available multi-CPU slots" Amount of RAM, including number of chips and empty slots" Disk space and configuration, including any RAID or fault tolerancesettings" Network card type, configuration, and network address" Peripheral cards, such as SCSI, and video&' Software" Operating system version number, including kernel version and patches" Versions of all other installed softwareAs part of your system documentation, you should also keep track of any hardwaremaintenance or software upgrades.You will greatly benefit from this informationduring troubleshooting, because you will always have an accurate record of what iscurrently running on the system, and what parts have been replaced or upgraded.This information is especially important when keeping track of kernel or softwareupgrades.By upgrading one component, you may create an incompatibility withanother component.Only by keeping track of these changes can you go back to findwhich upgrade caused the problem.You should routinely keep track of CPU, RAM, and disk usage so that you can proac-tively plan any resource upgrades that your system may need in the future.By plot-ting your usage trends, you can tell whether you need to order extra hard drives tocorrect any future disk space problems.Table 13-1 is an example of the type ofinformation that you should be tracking.Table 13-1Linux System Maintenance LogDate Action Performed NameMay 13, 2001 Upgraded Apache Web Server to 1.3.2 J.SmithJune 22, 2001 Upgraded kernel to 2.4 T.GreenJuly 5, 2001 Upgraded Squid Proxy Server to 2.4 J.SmithJuly 15, 2001 Replaced failed hard drive in RAID 5 array bay 2 J.Smith 194881-6 ch13.F 11/12/01 8:31 AM Page 422Part V &' Maintaining the Linux System422SummaryThis chapter details many commands that you can use for process management.Commands like psand killhave many different options that the Linux systemadministrator can utilize.The administrator should also regularly check the varioussystem log files for errors, warnings, and information items that can help to proac-tively monitor the system.This chapter also emphasizes the importance of main-taining accurate hardware, software, and maintenance information.Here are somekey points to remember from this chapter:&' ps: Lists current users processes&' ps e: Lists all processes&' ps f: Uses full listing&' ps u: Lists processes of a particular user&' kill: Terminates a process&' killall: Terminates several instances of the same process by name&' kill 9: Sends a kill signal if a conventional kill command does not work&' kill HUP: Kills the process and restarts it&' top: Real-time list of all processes and resource usage&' System and kernel messages are written to /var/log/messages&' &' &' 194881-6 ch13.F 11/12/01 8:31 AM Page 423Chapter 13 &' Study Guide423423STUDY GUIDEThe Study Guide section provides you with the opportunity to test your knowledgeabout the Linux+ exam objectives that are covered in this chapter.The AssessmentQuestions provide practice for the real exam, and the Scenarios provide practicewith real situations.If you get any questions wrong, use the answers to determinethe part of the chapter that you should review before continuing.Assessment Questions1.An administrator wants to terminate the sendmail process on a Linux server.What is the best way to determine the PID of the sendmail process so it canbe killed?A.pstreeB.ps -ef | grep sendmailC.ps -u user1D.kill -9 sendmail2.An administrator has tried to use the killcommand to terminate a runningprocess.Unfortunately, the command didn t work, and the administrator canstill see the process when she uses the pscommand to show running pro-cesses.What command should be used next to terminate the process?A.killallB.ps -kC.topD.kill -93.When a Linux system boots, a kernel error message flashes across the screen,but it scrolls by before the user can determine the problem.What log file canbe checked to examine boot time messages?A./var/log/dmesgB./var/log/messagesC./tmp/messagesD./var/log/wtmp 194881-6 ch13
[ Pobierz całość w formacie PDF ]