Category: System Operation Others （系统操作其它）

Posted on

Several situations of Linux automatically reboot without reboot logs in the /var/log/messages

Situation One

This Linux server is a virtual server. If we reboot it though its virtual software, there is no relevant logs in the /var/log/messages.

Situation Two

This Linux server is a member of a pacemaker cluster. If the pacemaker cluster software fences this server for protecting the whole cluster, there is no relate logs in the /var/log/messages.

Situation Three

This Linux server has critical problems in its system or hardware. Core panic of Linux and hardware problem both can reboot the system automatically without any reboot logs in the /var/log/messages.

Posted on

[步骤] Linux 关机前执行脚本

步骤一：创建要被管理的脚本

# vim /root/12456.sh

创建以下内容：

#!/bin/bash
for i in {1..5}
do
echo $i
done

（补充：这里以创建 /etc/root/for.sh 脚本为例）

步骤二：创建 systemctl 的管理文件

# vim /etc/systemd/system/12456.service

创建以下内容：

[Unit]
Description=12345
After=getty@tty1.service display-manager.service plymouth-start.service
Before=systemd-poweroff.service systemd-halt.service
DefaultDependencies=no

[Service]
ExecStart=/root/12456.sh
Type=forking

[Install]
WantedBy=poweroff.target
WantedBy=reboot.target
WantedBy=halt.target

（补充：这里以创建 /etc/systemd/system/12456.service 来管理 ExecStart=/root/12456.sh 为例）

步骤三：加载刚刚创建的 systemctl 管理文件

# systemctl daemon-reload

步骤四：给 systemctl 的管理文件添加执行权限

# chmod u+x /etc/systemd/system/12456.service

步骤五：设置关机前执行脚本

5.1 设置关闭系统前执行此脚本

# ln -s /usr/lib/systemd/system/12456.service /usr/lib/systemd/system/halt.target.wants/

5.2 设置关闭电源前执行此脚本

# ln -s /usr/lib/systemd/system/12456.service /usr/lib/systemd/system/poweroff.target.wants/

5.3 设置重启先执行此脚本

# ln -s /usr/lib/systemd/system/12456.service /usr/lib/systemd/system/reboot.target.wants/
Posted on

[内容] Linux 查看 auditd 日志的案例

案例一：查看文件创建记录

# /usr/sbin/ausearch --start $(date +\%m/\%d/\%Y -d "-1 month") -i --input-logs | egrep "/test/test.txt.*nametype=CREATE" | awk '{print $2,$3,$6}'

（补充：这里以查看 /test/test.txt 文件有没有被创建为例）

案例二：查看文件删除记录

# /usr/sbin/ausearch --start $(date +\%m/\%d/\%Y -d "-1 month") -i --input-logs | egrep "/test/test.txt.*nametype=DELETE" | awk '{print $2,$3,$6}'

（补充：这里以查看 /test/test.txt 文件有没有被删除为例）

案例三：查看文件有没有存在过

# /usr/sbin/ausearch --start $(date +\%m/\%d/\%Y -d "-1 month") -i --input-logs | egrep "/test/test.txt.*nametype=" | awk '{print $2,$3,$6}' | uniq

（补充：这里以查看 /test/test.txt 文件有没有存在过为例）