Linux with Operating System Concepts

devicename
, as in 
iostat -x /dev/sda5
. This report includes the number of sectors read/written per 
second, the average size of requests, and the average wait time.
One last program worth noting is who. Although this merely lists the logged users of the 
system, if you use this program often, you can see how many users are commonly using the 
system and where they are logged in from. You can also obtain this information by viewing 
log files (see the next section) that store log-in attempts.
With all these programs, you are able to obtain several views of the system. First, you 
can see current statistics to see if there are immediate problems such as too heavy a demand 
because of too many processes or too many users. Second, you can view the statistics over 
an interval of time to see if heavy loads are occurring frequently or infrequently. Third, you 
can view averages over the interval. Most intervals are from the last boot.
You might save some of the statistics into files before rebooting so that you can compare 
performance over a greater period of time. By viewing statistics accumulated over weeks or 
months, you can obtain evidence that your system might need an upgrade.
See Table 14.4 for a summary of the various tools discussed in this section.
14.5 LOG FILES
We explored the syslogd (rsyslogd) service in Chapter 11. Through this daemon, we are 
able to log events that are generated from systems and applications software. Additionally, 
klogd logs kernel events. In most cases, kernel events are logged to the same collection of 
files. When you review one of these log files, you will find each entry preceded by one of 
syslogd (rsyslogd) or kernel to indicate what initiated the event.
Log files can be used to help the system administrator interpret the current and previ-
ous status of the system. Searching log files is a critical part of ensuring that your system is 
running smoothly and of troubleshooting problems. You may or may not inspect log files 
often but it is a good place to look when issues arise.
There are, in fact, a great many pieces of information that can be gleaned from examin-
ing log files. These include
• Who is and has tried to log in.
• What services were successfully started or stopped at system initialization time.
• Events related to hardware or software errors.
• What yum updates and installations occurred (successfully or unsuccessfully).
• What jobs successfully ran via crontab.

---

Maintaining and Troubleshooting Linux
◾
595
• Who has accessed your Apache web server and which pages have been requested (if 
you are running Apache).
Here, we look at some specific log files: what software wrote to them and what informa-
tion you might find there.
14.5.1 syslogd Created Log Files
We return to the /
etc/syslog.conf
(or /
etc/rsyslog.conf
) file covered in Chapter 
11. In this file, you will find logging events and logging locations. You might find the fol-
lowing entries:
*.info /var/log/messages
mail.none 
/var/log/messages
authpriv.none /var/log/messages
cron.none 
/var/log/messages
authpriv.* 
/var/log/secure
mail.* /var/log/maillog
cron.* /var/log/cron
uucp,news.crit
/var/log/spooler
local7.* 
/var/log/boot.log
TABLE 14.4 
Various System Administration Monitoring Programs