Linux uulog Command with Practical Examples

Introduction

In this lab, you will learn how to use the Linux uulog command to view and manage system log entries. The uulog command is a powerful tool that allows you to access and filter log files, making it easier to troubleshoot system issues and monitor system activity. You will start by understanding the purpose and syntax of the uulog command, then learn how to view system log entries and filter them based on various criteria, such as priority level, user, and date. This lab covers the essential aspects of using the uulog command in your daily system administration tasks.

Linux Commands Cheat Sheet

Skills Graph

Understand the Purpose and Syntax of the uulog Command

In this step, you will learn about the purpose and syntax of the uulog command in Linux. The uulog command is used to view and manage system log entries.

First, let's understand the purpose of the uulog command. The uulog command is a utility that allows you to view and search the system log files, which are typically stored in the /var/log directory. It provides a convenient way to access and filter log entries, making it easier to troubleshoot system issues and monitor system activity.

Now, let's explore the syntax of the uulog command:

uulog [options] [log_file]

Here's a breakdown of the available options:

• -a: Display all log entries, including those from previous boot sessions.
• -b [n]: Display log entries from the nth most recent boot.
• -f: Follow the log file, continuously displaying new entries as they are added.
• -n [number]: Display the last number of log entries.
• -p [priority]: Display log entries with the specified priority level (e.g., emerg, alert, crit, err, warning, notice, info, debug).
• -t [date]: Display log entries from the specified date and time.
• -u [user]: Display log entries associated with the specified user.

Example:

$ uulog -n 10

This command will display the last 10 log entries.

$ uulog -p err

This command will display all log entries with the "error" priority level.

$ uulog /var/log/syslog

This command will display the contents of the /var/log/syslog log file.

Remember, the uulog command is a powerful tool for managing and troubleshooting system logs in Linux. Understanding its syntax and options will help you effectively use this command in your daily system administration tasks.

View System Log Entries Using the uulog Command

In this step, you will learn how to use the uulog command to view system log entries.

First, let's take a look at the default system log file, /var/log/syslog:

$ sudo uulog /var/log/syslog

This will display the contents of the /var/log/syslog file. You can see various log entries related to system events, such as startup, service status, and error messages.

To view the last 10 log entries:

$ sudo uulog -n 10

This will display the most recent 10 log entries.

You can also view log entries from a specific date and time:

$ sudo uulog -t "2023-04-01 12:00:00"

This will display log entries from the specified date and time.

To view log entries with a specific priority level, such as errors:

$ sudo uulog -p err

This will display all log entries with the "error" priority level.

Example output:

Apr 01 12:34:56 myhost kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd SRC=192.168.1.100 DST=192.168.1.101 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=1122 PROTO=TCP SPT=12345 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0
Apr 01 12:35:01 myhost CRON[12345]: (root) CMD (command to be executed)
Apr 01 12:35:10 myhost sshd[12346]: Failed password for invalid user example from 192.168.1.100 port 12345 ssh2

Remember, the uulog command provides a convenient way to access and filter system log entries, which can be helpful for troubleshooting and monitoring your system.

Filter and Search Log Entries with the uulog Command

In this step, you will learn how to filter and search log entries using the uulog command.

Filtering log entries by priority level:

$ sudo uulog -p err

This will display all log entries with the "error" priority level.

You can also filter log entries by user:

$ sudo uulog -u root

This will display all log entries associated with the "root" user.

To search for specific keywords in the log entries:

$ sudo uulog | grep "failed login"

This will display all log entries containing the phrase "failed login".

You can combine multiple filters to narrow down your search:

$ sudo uulog -p err | grep "sshd"

This will display all error-level log entries related to the sshd service.

Example output:

Apr 01 12:35:10 myhost sshd[12346]: Failed password for invalid user example from 192.168.1.100 port 12345 ssh2
Apr 02 15:22:33 myhost sshd[12347]: Connection closed by 192.168.1.101 port 12346 [preauth]

The uulog command provides a powerful way to filter and search through system log entries, making it easier to identify and troubleshoot issues on your Linux system.

Summary

In this lab, you learned about the purpose and syntax of the uulog command in Linux. The uulog command is a utility that allows you to view and search the system log files, which are typically stored in the /var/log directory. You explored the available options for the uulog command, such as displaying all log entries, filtering by priority level, and viewing log entries from a specific date and time or associated with a particular user. Additionally, you learned how to use the uulog command to view the contents of the default system log file, /var/log/syslog, and follow the log file to continuously display new entries as they are added.

Linux Commands Cheat Sheet