What are the main system logs to look at???

[Shaun Aldrich]

Hello everyone,

I want to look at the various system logs to see what type of activity went on between 2am last night and now.

What type of logs are good to look at? Any type of security logs may be helpful as well.

So far I have looked at the following:-

/var/adm/syslog/syslog.log
/var/adm/sulog

Any others would be greatly appreciated...

Thanks
Shaun Aldrich

[Cheryl Griffin · Accepted solution]

Shaun,

You can get a pretty complete listing of system logs by going into SAM --> Routine Tasks --> System Log files. Here you can look at files but also routinely trim log files as part of system maintenance.

/etc/shutdownlog is good for tracking when/why the system was shutdown. (Look here first if you suspect a system panic.)

If you need to track login information, look at /etc/*tmp files (wtmp, btmp, utmp).

For software and patch installation information, look at /var/adm/sw/swinstall.log and /var/adm/sw/swagent.log.

The list of log files could grow quite large here depending on how your system is configured and what you are trying to trace.

[Stefan Farrelly]

some of the good system logs are in binary format so you will have to use other commands to view them;
last and lastb to see logins and bad logins
If you have measureware installed you will need PerfView to view very detailed performance and process logging from last night.
To view the auditing logs (if enabled) you should use sam to view them.
The hardware logs should be viewed using stm (xstm).

[CHRIS_ANORUO]

They ones stated above are okay. Use last -R, also if you have sar enable to run through cron, try sar -M, sar -d.

[CHRIS_ANORUO]

They ones stated above are okay. Use last -R, also if you have sar enable to run through cron, try sar -M, sar -d.

[Kofi ARTHIABAH]

...and to help to monitor the content of these files, you can configure swatch
available at http://wuarchive.wustl.edu/packages/security/swatch/

Name : swatch
Version : 2.2
Size : 132477 bytes
Summary : A utility for monitoring system logs files.
Group : Applications/System
Requires : /usr/bin/perl
Description :

The Swatch utility monitors system log files, filters out unwanted
data and takes specified actions (i.e., sending email, executing a
script, etc.) based upon what it finds in the log files.

Install the swatch package if you need a program that will monitor log
files and alert you in certain situations.