linux日志监控工具logwatch使用介绍

logwath是linux操作系统用于监控日志并生成报告的实用工具,在READHAT Linux已经预装,下面简单介绍如何使用:

 

显示帮助

log]# logwatch --help

Usage: /usr/sbin/logwatch [--detail ] [--logfile ]
   [--print] [--mailto ] [--archives] [--range ] [--debug ]
   [--save ] [--help] [--version] [--service ]
   [--splithosts] [--multiemail]

--detail : Report Detail Level - High, Med, Low or any #.
--logfile : *Name of a logfile definition to report on.
--service : *Name of a service definition to report on.
--print: Display report to stdout.
--mailto : Mail report to .
--archives: Use archived log files too.
--save : Save to .
--range : Date range: Yesterday, Today or All.
--debug : Debug Level - High, Med, Low or any #.
--splithosts: Create a report for each host in syslog.
--multiemail: Send each host report in a separate email.  Ignored if
              not using --splithosts.
--version: Displays current version.
--help: This message.
* = Switch can be specified multiple times...

 

基本使用:

logwatch --print  显示过去一天内log分析报告, 报告形式以serviec单位分组,如:

logwatch --print

 ################### LogWatch 5.2.2 (06/23/04) ####################
       Processing Initiated: Tue Jul 15 16:11:40 2008
       Date Range Processed: yesterday
     Detail Level of Output: 0
          Logfiles for Host: ****
 ################################################################

 --------------------- Kernel Begin ------------------------

WARNING:  Kernel Errors Present
   hda: irq timeout: error=0x00...:  391 Time(s)

 ---------------------- Kernel End -------------------------

 --------------------- pam_unix Begin ------------------------

su:
   Sessions Opened:
      mayj(uid=0) -> oracle: 5 Time(s)

 ---------------------- pam_unix End -------------------------

 --------------------- sendmail Begin ------------------------

 

Bytes Transferred: 44922
Messages Sent:     6
Total recipients:  14
 ---------------------- sendmail End -------------------------

 --------------------- SSHD Begin ------------------------

Users logging in through sshd:
   mayj:
      121.0.31.121: 10 times

 ---------------------- SSHD End -------------------------

 

------------------ Disk Space --------------------

/dev/cciss/c0d0p1     244M   15M  216M   7% /boot
***

 ###################### LogWatch End #########################

指定log分析级别

logwatch --print --detail high  (--detail 后面可以指定low,middle,high)

 

指定分析时间段:

logwatch --print --range Today  (--range后面可以指定Yesterday, Today or All)

 

指定分析的服务组:

如只分析Kernel相关部分:  logwatch --print --service Kernel (可以跟多个--service参数)

 

查看版本:

logwatch --version
Logwatch 5.2.2 (released 06/23/04)

 

作者:George.Ma

BLOG: http://blog.chinaunix.net/u/12521/