CentOS V5-6. User Guide

Size: px

Start display at page:

Download "CentOS V5-6. User Guide"

Audrey Higgins
6 years ago
Views:

1 CentOS V5-6 User Guide

2 1 Table of Contents 1 Table of Contents Installation via Logtrust repository Update via Logtrust repository Installation via.rpm packages Configuration/reconfiguration Uninstalling Tested Versions Common errors in CentOS Common errors in CentOS 5.x How to monitor files in CentOS using wildcards... 10

3 2 Installation via Logtrust repository 1. Add Logtrust repository to the system repository list (you only need to perform this step once). 2. Create the following file: /etc/yum.repos.d/logtrust.repo file [logtrust] name=logtrust baseurl= enabled=1 gpgcheck=1 gpgkey= 3. Import public key (you only need to perform this step once): Import Logtrust repository public key sudo rpm --import 4. Install Logtrust packages: Installation of Logtrust packages sudo yum install logtrust-system logtrust-monitor 5. Perform the initial configuration: Initial configuration of Logtrust package sudo logtrust-system-configure sudo logtrust-monitor-configure 3

4 3 Update via Logtrust repository To upgrade to the latest version of any Logtrust packages, we will follow the same procedure as a standard distribution package. See below an example of RPM based distributions: RPM package update # yum --enablerepo=logtrust clean metadata # yum update logtrust-system # logtrust-system-configure 4

5 4 Installation via.rpm packages Install the following RPM packages:.rpm packages installation sudo rpm -ivh sudo rpm -ivh 5

6 5 Configuration/reconfiguration If you need to reconfigure any of the packages, please run the following command: Package reconfiguration commands sudo logtrust-system-configure sudo logtrust-monitor-configure 6

7 6 Uninstalling Run one of these two commands: Remove Package yum erase logtrust-package rpm -e logtrust-package 6.1 Tested Versions CentOS 6.x CentOS 5.x 7

8 7 Common errors in CentOS In CentOS SELinux is disabled by default (run getenforce to check the status). If you are using CentOS with SELinux enabled you have to modify SELinux policy to allow rsyslog to report its events to Logtrust. For more information, check syslog & SELinux configuration 1 article. 7.1 Common errors in CentOS 5.x CentOS 5.x uses a syslog-ng daemon instead of rsyslog. You have to uninstall syslogng and install rsyslog: 1. Use the following commands: Replace syslog-ng for rsyslog rpm --nodeps -e syslog-ng rm /var/run/syslogd.pid yum install rsyslog 2. On the /etc/sysconfig/rsyslog file, change the SYSLOGD_OPTIONS variable for: File /etc/sysconfig/rsyslog SYSLOGD_OPTIONS="-c 3" 3. Add the following line at the beginning of the /etc/rsyslog.conf file: File /etc/rsyslog.conf $IncludeConfig /etc/rsyslog.d/*.conf 4. Create the directory if necessary: Rsyslog dir mkdir /etc/rsyslog.d/ 5. Logtrust-monitor package requires a newer version of Python than the one that comes with CentOS 5.x.Update Python version: 1 8

9 Updating python version yum install python26 6. Finally, you must edit the following files: /opt/logtrust/monitor/diskstat/diskstat /opt/logtrust/monitor/dstat/dstat /opt/logtrust/system/downloadcerts.py 7. Replace the first line (#!/usr/bin/env python) with #!/usr/bin/python26. 9

10 8 How to monitor files in CentOS using wildcards See below the procedure to use in order to monitor files in CentOS using the wildcards: 1. Execute the following commands to download and install the latest version of rsyslog. yum install y wgey wget mv rsyslog.repo /etc/yum.repos.d/rsyslog.repo yum info rsyslog --skip-broken yum install -y rsyslog rsyslogd -version 2. Edit the file: /etc/rsyslog.d/00-lt-init.conf. Replace the first line and save it. #$ModLoad imfile module(load="imfile" mode="inotify") 3. Edit the file: /etc/rsyslog.d/45-test.conf. Replace the first paragraph with the following lines: # File 1 input(type="imfile" File="/var/log/wild*.log" Tag="my.app.wild:" Severity="info" Facility="local7" reopenontruncate="on" PersistStateInterval="1") Wildcards are supported at file level, not at directory level. /var/log/applog*.log is valid /var/applog*/logfile.log is not valid Subdirectories that match the wildcard are not processed. if /var/log/applog-dir.log is a directory, it will not be processed Wildcards do not work in polling mode. 4. Restart rsyslog. 10

Linux Systems Security. Logging and Network Monitoring NETS1028 Fall 2016

Linux Systems Security. Logging and Network Monitoring NETS1028 Fall 2016 Linux Systems Security Logging and Network Monitoring NETS1028 Fall 2016 Monitoring Monitoring can take many forms, from passive periodic inspection to realtime intrusion detection For this unit, we will