In older Linux systems, the logger command can be used to send a log message to syslog.
Reading where does logger log its messages to in Arch Linux?, it seems that syslog messages and the logger command line app only talk to the systemd journal if a socket for message forwarding is set up.
So what's the modern equivalent of the logger command? How can I send a message directly to the systemd journal from the command line?
It is company policy for admins to login to the servers via a personal username, and then run sudo -i to become root. Upon running sudo -i, sudo will create an environmental variable called SUDO_USER, which contains the original user's username.
Is there a way to log ALL commands within syslog with something akin to the following syntax:
${TIME/DATE STAMP}: [${REAL_USER}|${SUDO_USER}]: ${CMD}
An example entry would be:
Sat Jan 19 22:28:46 CST 2013: [root|ksoviero]: yum install random-pkg
Obviously it doesn't have to be exactly the above syntax, it just has to include a minimum of the real user (eg. root), the sudo user (eg. ksoviero), and the full command that was run (eg. yum install random-pkg).
I've already tried snoopy, but it did not include the SUDO_USER variable.
I've just tried logging into a Fedora (release 13 Goddard) server using SSH (PuTTY, Windows). For some reason the Enter after typing my username didn't go through and I typed in my password and hit Enter again. I only realized my mistake when the server greeted me with a happy
myusername MYPASSWORD@server.example.com's password:
I broke off the connection at this point and changed my password on that machine (through a separate SSH connection).
... now my question is: Is such a failed login stored in plain text in any logfile? In other words, have I just forced my (now-outdated) password in front of the eyes of the remote admin the next time he scans his logs?
Update
Thanks for all the comments about the implied question "what to do to prevent this in the future". For quick, one-off connections I'll use this PuTTY feature now:
to replace the where-was-it-again "auto-login username" option
I'll also start using ssh keys more often, as explained in the PuTTY docs.
I have a constantly running script that I output to a log file:
script.sh >> /var/log/logfile
I'd like to add a timestamp before each line that is appended to the log. Like:
Sat Sep 10 21:33:06 UTC 2011 The server has booted up. Hmmph.
Is there any jujitsu I can use?
I was wondering if there was a proper way to clear logs in general?
I'm new to Ubuntu and I'm trying to set up Postfix. The log in question is /var/log/mail.log. I was wondering if there was a correct way to clear it, rather than me going in it and deleting all the lines and saving it. I find that sometimes errors don't get written to it immediately after I clear the log and save it.
Side note: I'm having trouble setting up Postfix and am trying to make it easier for me to read the logs hoping it can help me out, instead of having to scroll all the way down.