Linux日志分析

<p style="text-indent:2em">Linux系统日志是记录了系统运行状态、程序运行情况以及系统事件的文件。它包含了各种级别的信息，从调试信息和错误报告到警告和系统事件等。Linux系统日志主要分为四个部分：内核日志、系统日志、安全日志和应用程序日志。</p>

/var/log/wtmp   wtmp日志文件永久记录每个用户登录和退出、数据交换、关机及重启的信息。
last命令

/var/log/lastlog    记录系统中所有用户最后一次登录时间的日志
lastlog命令
    
/var/log/btmp   记录Linux登陆失败的用户、时间以及远程IP地址
lastb命令
```

/var/log/secure 日志分析技巧：
```
1、定位有多少IP在爆破主机的root帐号：    
grep "Failed password for root" /var/log/secure | awk '{print $11}' | sort | uniq -c | sort -nr | more

定位有哪些IP在爆破：
grep "Failed password" /var/log/secure|grep -E -o "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"|uniq -c

爆破用户名字典是什么？
grep "Failed password" /var/log/secure|perl -e 'while($_=<>){ /for(.*?) from/; print "$1\n";}'|uniq -c|sort -nr
 
2、登录成功的IP有哪些： 	
grep "Accepted " /var/log/secure | awk '{print $11}' | sort | uniq -c | sort -nr | more

登录成功的日期、用户名、IP：
grep "Accepted " /var/log/secure | awk '{print $1,$2,$3,$9,$11}'

3、增加一个用户kali日志：
Jul 10 00:12:15 localhost useradd[2382]: new group: name=kali, GID=1001
Jul 10 00:12:15 localhost useradd[2382]: new user: name=kali, UID=1001, GID=1001, home=/home/kali
, shell=/bin/bash
Jul 10 00:12:58 localhost passwd: pam_unix(passwd:chauthtok): password changed for kali
#grep "useradd" /var/log/secure

4、删除用户kali日志：
Jul 10 00:14:17 localhost userdel[2393]: delete user 'kali'
Jul 10 00:14:17 localhost userdel[2393]: removed group 'kali' owned by 'kali'
Jul 10 00:14:17 localhost userdel[2393]: removed shadow group 'kali' owned by 'kali'
# grep "userdel" /var/log/secure

5、su切换用户：
Jul 10 00:38:13 localhost su: pam_unix(su-l:session): session opened for user good by root(uid=0)

sudo授权执行:
sudo -l
Jul 10 00:43:09 localhost sudo:    good : TTY=pts/4 ; PWD=/home/good ; USER=root ; COMMAND=/sbin/shutdown -r now
```
```
发现大量爆破日志，可以统计一下
grep -o "Failed password" auth.log* | uniq -c
统计爆破用户
strings auth.log* | grep  "Failed password"  |  awk '{print $9}' | uniq -c
grep "Failed password" /var/log/auth*|perl -e 'while($_=<>){ /for(.*?) from/; print "$1\n";}'|uniq -c|sort -nr
发现存在两个用户都被爆破，查看登陆情况
strings auth.log* | grep  "Accepted" | awk '{print $1,$2,$3,$7,$9,$11}'
查看两个用户开始爆破的时间
strings auth.log* | grep  "Failed password" |uniq -c | grep zyr | head -n 2
strings auth.log* | grep  "Failed password" |uniq -c | grep wxiaoge | head -n 2
```

导航

最近文章

友情链接