日志查看审计程序&＃xff0c;尚未完成&＃xff0c;初步设想见设计图
- Auditlog
- Help
-
- $ auditlog
- Usage:
- Homepage: http://netkiller.github.com
- Author: Neo
-
- Options:
- -h, --help show this help message and exit
- -d, --daemon run as daemon
- -l LOGFILE, --logfile&＃61;LOGFILE
- log file example: /var/log/message
- -r REGEX, --regex&＃61;REGEX
- regex/regexp example: ^Feb
- --regular&＃61;REGULAR regular file
- --debug Print debug information
- Search keyword by regular
-
- $ python3 auditlog -l /var/log/syslog -r "\/etc\/cron.hourly\)$"
- Feb 24 07:17:01 ubuntu CRON[28905]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
- Feb 24 08:17:01 ubuntu CRON[29888]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
- Feb 24 09:17:01 ubuntu CRON[31136]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
- Feb 24 10:17:01 ubuntu CRON[32231]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
- Feb 24 11:17:01 ubuntu CRON[841]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
- Feb 24 12:17:01 ubuntu CRON[1977]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
- Feb 24 13:17:01 ubuntu CRON[3059]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
- Feb 24 14:17:01 ubuntu CRON[4263]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
- Feb 24 15:17:01 ubuntu CRON[5335]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
- Feb 24 16:17:01 ubuntu CRON[6573]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
-
- $ python3 auditlog -l /var/log/syslog -r "^Feb"
- Feb 24 06:48:30 ubuntu rsyslogd: [origin software&＃61;"rsyslogd" swVersion&＃61;"5.8.11" x-pid&＃61;"829" x-info&＃61;"http://www.rsyslog.com"] rsyslogd was HUPed
- Feb 24 06:48:30 ubuntu CRON[27658]: (CRON) info (No MTA installed, discarding output)
- Feb 24 07:09:01 ubuntu CRON[28764]: (root) CMD ( [ -x /usr/lib/php5/maxlifetime ] && [ -x /usr/lib/php5/sessionclean ] && [ -d /var/lib/php5 ] && /usr/lib/php5/sessionclean /var/lib/php5 $(/usr/lib/php5/maxlifetime))
- Feb 24 07:17:01 ubuntu CRON[28905]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
-
- $ auditlog -l /var/log/syslog --regular&＃61;syslog.reg
-
- $ auditlog -l /var/log/syslog --regular&＃61;syslog.reg -r &＃39;^Feb&＃39;
- Configure
-
- auditlog.ini
-
- [syslog]
- logfile&＃61;/var/log/syslog
- ;exclude&＃61;share/syslog.reg
- include&＃61;share/syslog.reg
-
- [dmesg]
- logfile&＃61;/var/log/dmesg
- include&＃61;share/dmesg.reg
- ;exclude&＃61;
-
- [dpkg]
- logfile&＃61;/var/log/dpkg.log
- include&＃61;share/dpkg.reg
- exclude&＃61;share/dpkg1.reg
- regular
-
- $ cat syslog.reg
- ^Feb
- :09:
- Daemon
-
- $ python3 auditlog -d
京公网安备 11010802041100号