Linux环境下syslog日志管理系统研究

Research on Log Management System in Linux

随着Internet和网络应用系统的发展和普及,网络攻击行为不断升级,严重影响了系统的正常运行,系统安全问题已引起人们的高度重视。多数应用系统通常采用Linux作为服务器操作系统,日志是Linux系统重要的安全特性,对于系统安全极为重要。通过它可以方便地查找出系统错误或受到的攻击。基于对Linux Red Hat9．0的研究,文中对syslog协议、日志服务器的建立以及使用logrotate对日志进行轮循管理进行了详细说明,还对Syslog日志管理系统的安全性进行了简要分析,提出了现有Syslog机制存在的问题和未来的发展方向。

Logs are critical asset to effective system security. It＇s easy to track down problems or attacks by keeping logs. This paper discusses the application of logs in Linux system security based on Red Hat 9. 0, which covers the syslog protocol, syslog configuration, remote log server building and logs rotation with logrotate. The security of logs management is analyzed. At the end of this article, the deficiency of current system and the future trend are pointed out.