The analysis of logs
are one of the biggest important things you're going to do
as a system administrator.
Everything that happens in the system is logged typically.
And so being able to process the information
and also not deal with information overload
by only keying in on specific information that's relevant
to what you're trying to do, will also be key.
So we're going to go through and configure the rsyslog
and we're going to set it up to send information remotely
to our partners server.
And we're also going to check out the journal control command
and our last command.
And again, this is going to give us a lot information
of different type of logs that are on the system.
So first thing we need to do,
we're going to modify our rsyslog,
log and config file in order to send the information
to our partner server.
So let's do that really quick.
Okay, so we're in this log.
Now what we need to do is change the configuration settings
to allow us to provide the TCP connection.
Okay, so that's where we're going to go down here first,
go into modules.
We're just going to go here to where it says
provide TCP syslog reception.
Okay, so now the hashtag
means that it's going to be commented out
and that line won't be processed
but we need to process line.
So pretty much we want to make sure this line here,
ModLoad imtcp and also input TCP server run 601.
That's the port we're going to be using
to transmit our log information.
Okay, now we're going to go down.
We're going to see the rules.
And again, these rules pretty much identify a faculty
and the severity of the log
that we want to do something with
and all the way to the right.
It's going to be the action we're going to take.
And when we just have the file locations
that's letting the system know,
Hey, whenever you get one of these faculties
with whatever severity you wanted to use,
we're going to send that to var log messages.
What we're going to focus on
is the failed attempts at logging in.
So we're going to set this up
to send all of our authorization logs to a remote server
and then we'll better review it from there, okay.
So, I'm going to go down here.
We're going to add this line, authpriv.
that means any level of severity from this type of faculty.
Okay, we're going to do @@ now what that means
is we're going to use TCP as our protocol, okay?
So we're do 10.0.2.16
that's the partner server.
We're going to use port 601, so that's a socket, okay.
So we have the IP address.
The port which is a socket, two at symbols
meaning we're going to use a TCP protocol.
Okay, and last thing we wanted to do is we want to edit this.
Like I was saying earlier
we don't want all information at all times.
Sometimes we want to specify to a certain level of severity.
So we're going to change the info text with a notice text.
It's going to be a level five severity.
So anything level five severity and above
meaning four, three, two, one, that will be sent.
So anything info below, it's not going to be sent here.
So let's go ahead and change this.
This info, notice, save this.
Let's go and exit.
So we're going to restart our rsyslog, okay.
So we're going to do sudo system control.
Okay, again, this is to let the system know,
Hey, we need you to reread that configuration file
cause we made some changes to it.
Okay, last but not least
we must modify the firewall rules to allow that port 601
that we just enable to be able to go in
and out of our network, okay.
Firewall command for our zone.
Add port 601 TCP.
We'll make this permanent.
Okay, lets do a system control.
I'll restart the firewall.
Okay, make sure that rule was added successfully.
Okay, we see 601 should be allowed.
Now let's test this out.
We're going to create an error.
I'm going to log into, just count ariley,
and purposely put the wrong password.
Now it may take a little bit for the configurations
to fully go through, but we're going to add ssh to the server.
Okay, now we're going to switch to root,
so we're able to have access to that particular folder.
All right, so now we should be able to see the last command.
I'm sorry, the last set of violations.
We're going to search it by ariley.
All right, now we see we're on the root server two
cause we added ssh into server.
And we can see now that there is a password failure
for the ariley and it's highlighted.
And again, that comes from us,
moves in server01.
Cause it sent the information over
and also you can identify that in about the fourth row.
We'll see server01,
that's the source of that information.
So that was a successful remote configuration
for the rsyslog.
Now, since we're in this root server,
we're going to have continue to use this one.
And we're just going to go through
and try out the journal control commands.
Now again, the journal control is the command
for the journal Damon.
Again, that runs as soon the system starts up
and it collects a plethora of logs
and this groups everything in together
and you're able to use the journal control command
to specify what type of information you want to filter down
to exactly what you need.
So let's use journal control.
Okay, now we see there's a lot of information.
We're talking about kernel initialization.
We're talking about any type of hard dis memory,
you name it.
Everything's stored.
Okay, see it's a lot of information here.
Let's get out of here.
Now we can also, like I said, tailoring
only on information that we need.
So look for a notice level.
Okay, so notice level of severities.
That's what we're looking at now.
Again, it's a lot of those, okay.
Again, we can search through this as well.
Again, we can always use grep for anything.
We want to focus on something from the kernel.
Okay, easy as that.
Again, journal control tailors down the massive monologues
to only what we're looking for.
Okay, now also if you want to get the most recent journals,
do that and it also gives us an update
as things are coming in as well.
So it's not only for as snapshot.
It's going to add new information too, okay.
We're also able to specify the time
so we can use journal troll again,
and we're going to be able to use since "2 hours ago"
and until "30 minutes ago."
Okay, oo we can see that if we look at the time
that's what it's going to be through.
Now, you can't reference the time
that I'm currently using cause We're still remote,
but it's going to be from the past two hours
up to 30 minutes ago.
And the last one, at least we want to look at
how to specify information for a particular service.
So again, we're going to go use journal, the u option
that's to let us specify a specific service.
Okay, so everything relative to HTTP, the Apache server
we can see that,
not a lot hasn't been going on with Apache server.
We just started and it seems to be going good for us so far.
Last but not least, the last command.
Let's go give us our last set of logins.
So, it's only what it's focused on,
is logging in and logging in out, okay.
We see some of this information.
We can see myself logging in from a remote location.
You can see still logged in right here, server01,
that's what I logged in as
when I first switched over to ssh,
when I was able to look through remote logs.
We're also going to use the last B command.
And what that does is this shows a list
of bad login attempts.
Okay, so all these are the failure.
Okay, and then last but not least again,
use to the last log.
I'm going to verify that we can see the last time
that each user logged in.
All right, we went over how to use the rsyslog
to remotely send our logs to a remote server
and how to also use the journal control
and the last command to get detailed information
from our logs.
So we're able to troubleshoot, identify malicious behavior,
or spot misconfigurations.
Thank you for sticking through this walkthrough
and I'll see you in the next lesson.