Foreword
I'm finishing a project to collect and aggregate a number of emergency response cases (continually updated).
GitHub 地址：https://github.com/Bypass007/Emergency-Response-Notes
This paper describes the skills Linux log analysis, more detailed information, please visit Github address, welcomed the Star.
I. Introduction to Logs
Linux system has a very flexible and powerful log function, you can save almost all operating record, and can retrieve the information we need. This article about the Linux system logs and log analysis techniques.
The default log storage location: / var / log /
View log configuration: more /etc/rsyslog.conf
The more important the log :
-
Login failed record: / var / log / btmp // lastb
-
Last Login: / var / log / lastlog // lastlog
-
Login track record of success: / var / log / wtmp // last
-
Login Logging: / var / log / secure
-
Currently logged-on user information: / var / run / utmp // w, who, users
-
History records the command: history only to clean up the current user: history -c
Second, log analysis techniques
A, common shell commands
Commonly used Linux shell command such as: find, grep, egrep, awk, sed
1, before and after the grep display several lines of information:
- Standard unix / linux grep under control context by the following parameters:
- grep -C 5 foo file display file matches the file foo string up and down the line and five lines
- grep -B 5 foo file foo and display the first five lines
- grep -A 5 foo file foo display 5 and the rear row
- View the version number of grep is to
- grep -V
2、grep 查找含有某字符串的所有文件
grep -rn “hello,world!”
* : 表示当前目录所有文件，也可以是某个文件名
-r 是递归查找
-n 是显示行号
-R 查找所有文件包含子目录
-i 忽略大小写
3、如何显示一个文件的某几行：
cat input_file | tail -n +1000 | head -n 2000
#从第1000行开始，显示2000行。即显示1000~2999行
4、find /etc -name init
//在目录/etc中查找文件init
5、只是显示/etc/passwd的账户
cat /etc/passwd |awk -F ‘:’ ‘{print $1}’
//awk -F指定域分隔符为’:’，将记录按指定的域分隔符划分域，填充域，•$0则表示所有域,$1表示
6、sed -i ‘153,$d’ .bash_history
删除历史操作记录，只保留前153行
B、日志分析技巧
以这个日志为例：/var/log/secure
1、定位有多少IP在爆破主机的root帐号：
grep “Failed password for root” /var/log/secure | awk ‘{print $11}’ | sort | uniq -c | sort -nr | more
定位有哪些IP在爆破：
grep “Failed password” /var/log/secure|grep -E -o “(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)”|uniq -c
爆破用户名字典是什么？
grep “Failed password” /var/log/secure|perl -e ‘while($_=<>){ /for(.*?) from/; print “$1\n”;}’|uniq -c|sort -nr
2、登录成功的IP有哪些：
grep "Accepted " /var/log/secure | awk ‘{print $11}’ | sort | uniq -c | sort -nr | more
登录成功的日期、用户名、IP：
grep "Accepted " /var/log/secure | awk ‘{print $1,$2,$3,$9,$11}’
3、增加一个用户kali日志
Jul 10 00:12:15 localhost useradd[2382]: new group: name=kali, GID=1001
Jul 10 00:12:15 localhost useradd[2382]: new user: name=kali, UID=1001, GID=1001, home=/home/kali
, shell=/bin/bash
Jul 10 00:12:58 localhost passwd: pam_unix(passwd:chauthtok): password changed for kali
#grep “useradd” /var/log/secure
4、删除用户kali日志：
Jul 10 00:14:17 localhost userdel[2393]: delete user ‘kali’
Jul 10 00:14:17 localhost userdel[2393]: removed group ‘kali’ owned by ‘kali’
Jul 10 00:14:17 localhost userdel[2393]: removed shadow group ‘kali’ owned by ‘kali’
#grep “userdel” /var/log/secure
5、su切换用户：
Jul 10 00:38:13 localhost su: pam_unix(su-l:session): session opened for user good by root(uid=0)
sudo授权执行:
sudo -l
Jul 10 00:43:09 localhost sudo: good : TTY=pts/4 ; PWD=/home/good ; USER=root ; COMMAND=/sbin/shutdown -r now
2、/var/log/yum.log
Uninstall the software upgrade installation log:
yum install gcc
[root@bogon ~]# more /var/log/yum.log
Jul 10 00:18:23 Updated: cpp-4.8.5-28.el7_5.1.x86_64
Jul 10 00:18:24 Updated: libgcc-4.8.5-28.el7_5.1.x86_64
Jul 10 00:18:24 Updated: libgomp-4.8.5-28.el7_5.1.x86_64
Jul 10 00:18:28 Updated: gcc-4.8.5-28.el7_5.1.x86_64
Jul 10 00:18:28 Updated: libgcc-4.8.5-28.el7_5.1.i686