二、使用IPtables滚动日志
所有的日志文件都会随着时间的推移和访问次数的增加而迅速增长, 因此必须对日志文件进行定期清理以免造成磁盘空间的不必要的浪费。FC6下有一个专门的日志滚动处理程序logrotate,logrotate能够自动完成日志的压缩、备份、删除工作,系统默认把logrotate加入到系统每天执行的计划任务中,这样就省得管理员自己去处理了。
首先查看并确定logrotate的配置文件/etc/logrotate.conf内容如下:
# see "man logrotate" for details
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
#compress
# RPM packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
rotate 1
}
# system-specific logs may be also be configured here. |
然后在syslog的滚动日志配置文件/etc/logrotate.d/syslog里面添加IPtables的日志文件/var/log/iptables,详细内容如下:
/var/log/iptables /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
} |
最后安排logrotate每天执行一次,确定文件/etc/cron.daily/logrotate内容如下:
#!/bin/sh
/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
/usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0 |
至此我们就为IPtables创建了单独的滚动日志,可以更好地分析网络攻击信息。