查询 Syslog 表
查找 Linux 内核事件
查找 Linux 内核进程报告的有关终止进程的事件。
// To create an alert for this query, click '+ New alert rule'
Syslog
| where ProcessName == "kernel" and SyslogMessage contains "Killed process"
所有 Syslog
最后 100 个 Syslog。
Syslog
| top 100 by TimeGenerated desc
所有出现错误的 Syslog
带 erros 的最后 100 个 Syslog。
Syslog
| where SeverityLevel == "err" or SeverityLevel == "error"
| top 100 by TimeGenerated desc
所有 Syslog(按设施)
所有 Syslog(按设施)。
Syslog
| summarize count() by Facility
按进程名称的所有 Syslog
按进程名称的所有 Syslog。
Syslog
| summarize count() by ProcessName
按计算机添加到 Linux 组的用户
Lists将用户添加到 Linux 组的计算机。
Syslog
| where Facility == 'authpriv' and SyslogMessage has 'to group' and (SyslogMessage has 'add' or SyslogMessage has 'added')
| summarize by Computer
计算机创建的新 Linux 组
Lists创建了新 Linux 组的计算机。
Syslog
| where Facility == 'authpriv' and SyslogMessage has 'new group'
| summarize count() by Computer
失败的 Linux 用户密码更改
Lists Linux 用户密码更改失败的计算机。
Syslog
| where Facility == 'authpriv' and ((SyslogMessage has 'passwd:chauthtok' and SyslogMessage has 'authentication failure') or SyslogMessage has 'password change failed')
| summarize count() by Computer
Ssh 登录失败的计算机
Lists ssh 登录失败的计算机。
Syslog
| where (Facility == 'authpriv' and SyslogMessage has 'sshd:auth' and SyslogMessage has 'authentication failure') or (Facility == 'auth' and ((SyslogMessage has 'Failed' and SyslogMessage has 'invalid user' and SyslogMessage has 'ssh2') or SyslogMessage has 'error: PAM: Authentication failure'))
| summarize count() by Computer
具有失败的 Su 登录的计算机
Lists su 登录失败的计算机。
Syslog
| where (Facility == 'authpriv' and SyslogMessage has 'su:auth' and SyslogMessage has 'authentication failure') or (Facility == 'auth' and SyslogMessage has 'FAILED SU')
| summarize count() by Computer
Sudo 登录失败的计算机
Lists sudo 登录失败的计算机。
Syslog
| where (Facility == 'authpriv' and SyslogMessage has 'sudo:auth' and (SyslogMessage has 'authentication failure' or SyslogMessage has 'conversation failed')) or ((Facility == 'auth' or Facility == 'authpriv') and SyslogMessage has 'user NOT in sudoers')
| summarize count() by Computer
反馈
https://aka.ms/ContentUserFeedback。
即将发布:在整个 2024 年,我们将逐步淘汰作为内容反馈机制的“GitHub 问题”,并将其取代为新的反馈系统。 有关详细信息,请参阅:提交和查看相关反馈