11. System Monitoring

11.1.11 Practice Questions

CIST 2431

logger

Changes the message severity and where logged messages are sent.

/var/log/rpmpkgs

On Red Hat systems, the rpmpkgs file tracks installed packages. It also records all kernel packages on the system.

missingok

Prevents errors from being displayed for missing log files.

/var/log/warn

The warn file displays warning messages from many processes by default.

Tools to Troubleshoot Hardware Issues

When troubleshooting hardware issues, consider the following:

compress

Compresses old log files using gzip.

/proc/cpuinfo

Displays details about individual CPU cores. Output its contents with less or cat.

less more

Scrolls through individual pages of a file. e.g. less /var/log/messages allows you to scroll through each page of the file.

lastlog

Shows a list of the dates and times for the last login for each user.

head

Shows the first 10 lines of a file. e.g. head /var/log/messages shows the first 10 lines of the messages log.

Commands Used with logrotate

The following table describes the commands found in /etc/logrotate.conf or scripts in /etc/logrotate.d:

/var/log/maillog

The maillog file contains reports on mail server status and messages related to incoming and outgoing mail.

/var/log/messages

The messages file is the default file for storing system messages. This file may include copies of messages that appear on the console, internal kernel messages, and messages sent by networking programs. *The messages file is based on the init daemon, used on older Linux distributions

/etc/rsyslog.conf

The rsyslog.conf file is the main configuration file for the rsyslogd which logs system messages on Linux systems. This file specifies rules for logging. For every log message received rsyslog looks at its configuration file, /etc/rsyslog.conf to determine how to handle that message. If no rule statement matches the message, Rsyslog discards it.

/var/log/secure

The secure file logs any attempts to log in as the root user or attempts to use the su command. This file also contains information on remote logins and failed root user login attempts.

/var/log/boot.msg /var/log/boot.log

The system writes messages generated during the boot process to either the boot.log or boot.msg file depending on the distribution.

/var/log/kern.log

The var/log/kern.log file provides a detailed log of messages from the Linux kernel. These messages may prove useful for trouble-shooting a new or custom-built kernel

11.1.9 logrotate Facts

This lesson covers the following topics: How logrotate works Commands used with logrotate

dateext

Uses a daily extension on archived files using file.YYYYMMDD format. e.g. Uses a daily extension on archived files using a file.YYYYMMDD format.

Which of the following commands produced this output? 06:14:11 up 139 days, 24 min, 5 users, load average: 0.12, 0.33, 0.48 uptime top w ps

uptime The output was produced by entering the uptime command. w, top and ps provide similar and related information, but do not produce the output shown in this question.

/var/log/[application]

Many applications also create logs in the /var/log directory. If you list the contents of your /var/log subdirectory, you will see familiar names, such as /var/log/apache2 representing the logs for the Apache 2 web server, or /var/log/samba, which contains the logs for the Samba server.

A technician executed a command that collects various OS usage statistics, provides report capability, and saves system activity information. Which of the following commands produced the following output? sar free vmstat iostat

sar sar collects CPU usage, memory usage, swap space usage, overall I/O activity, individual device I/O, and network statistics. iostat reports CPU statistics and input/output for devices and partitions but does not produce the output. free displays information about the total amount of free and used physical and swap memory. It does not show other information in the output. vmstat displays information about processes, memory, paging, block I/O, traps, disks, and CPU activity.

Mary, a technician, is troubleshooting memory and performance issues on a system. Mary executed a command to show information about processes, memory, paging, block IO, traps, disks, and CPU activity. Which of the following commands did Mary use to produce the output below? free iostat vmstat top

vmstat vmstat displays information about processes, memory, paging, block I/O, traps, disks, and CPU activity. free displays information about the total amount of free and used physical and swap memory. It does not display other information. iostat reports CPU statistics and input/output for devices and partitions, but does not produce the output shown. top reports dynamic information on system processes, but does not produce this output.

vmstat

vmstat reports information about processes, memory, paging, block IO, traps, disks, and CPU activity. The first report produced gives averages since the last reboot. Additional reports give information on a sampling period of length delay. The process and memory reports are instantaneous in either case.

satyr

Algorithms for program failure processing, analysis, and reporting. More specifically, satyr: Generates a description of the failure from various stack traces Analyzes stack traces of failed processes. Discovers the thread that caused the failure, in multi-threaded stack traces. Generates a failure report in a specified format Sends the report to a remote machine.

How logrotate Works

On most distributions, logrotate: Linux distributions include the logrotate utility to automatically manage, compress, rename, and delete log files based on specific criteria, such as size or date. On most distributions, logrotate: Automatically runs each week as a cron job to periodically maintain system logs. Old logs are renamed with a numbered extension, and logs are deleted after 4 weeks. Uses /etc/logrotate.conf as the main configuration file. It contains entries that apply to the whole system. Uses scripts in /etc/logrotate.d to overwrite the settings in /etc/logrotate.conf.

vi gedit

Opens text files for editing. e.g. vi less /var/log/messages opens the messages log for editing.

maxage

Removes rotated logs that are older than the specified number of days. e.g. maxage 180 deletes every rotated log older than 180 days.

abrt-cli report <ID_OR_PATH>

Reports a problem. e.g. abrt-cli report aebfd1d843ec37f22e5c60d5d8002462c140e962 abrt-cli list report /var/spool/abrt/ccpp

faillog lastb

Shows all failed login attempts on the system (for example, the contents of the /var/log/btmp file or /var/log/faillog file, depending on the distribution).

last

Shows all users who have logged in to and out of the system as well as listing every connection and runlevel change (for example, the contents of the /var/log/wtmp file).

tail

Shows the last 10 lines of a file. Be aware of the following options: -f displays additions to the log in real time. -n# specifies the number of lines to display. e.g. tail /var/log/messages shows the last 10 lines of the messages log. tail -f /var/log/messages displays the real-time entries of the messages log as they are updated.

Centralized Logging

Since looking at individual log files can be cumbersome, especially if you have multiple servers or tiers in your architecture, a good practice is to centralize your logs in one place. With centralized logging, you are able to search through your logs quicker, which can help you solve issues faster. To take advantage of centralized logs, several third-party agents or daemons can be installed and used. The following table list a few daemons used for centralizing logs:

MaxFileSec

Specifies the maximum amount of time to store entries in the journal file before starting a new file.

MaxRetentionSec

Specifies the maximum amount of time to store journal entries. Any entries older then the specified time are automatically deleted from the journal file.

MaxLevelStore

Specifies the maximum log level of messages stored in the journal file. All messages equal to or less than the log level specified are stored. Any messages above the specified level are dropped. This parameter can be set to: emerg (0) alert (1) crit (2) err (3) warning (4) notice (5) info (6) debug (7)

rotate

Specifies the number of times to rotate the log before deleting it. e.g. rotate 5 rotates the log file five times and then removes it.

View and Manage Text-based Log Files

The following table describes commands to view and manage text-based log files:

Common Log Files

The following table describes the contents of commonly used log files.

View and Manage Binary Log Files

The following table lists several commands used to view and manage binary log files:

ABRT Tools and Commands

Use the following commands to manage ABRT information:

11.2.5 Practice Questions

CIST 2431

11.2.4 Using Uptime

In this lab, select View Lab and type uptime -h to find the correct option to answer the following questions: On which date was the CorpData server started? 2019 01 10 What time was the CorpData server started on that date? 10:14 Use uptime -h to find the date and time that the server was started.

Ishw

The lshw to is used to extract detailed information on the hardware configuration of the machine. It can report exact memory configuration, firmware version, mainboard configuration, CPU version and speed, cache configuration, bus speed, etc. on DMI-capable x86 or IA-64 systems and on some PowerPC machines (PowerMac G4 is known to work). It currently supports DMI (x86 and IA-64 only), OpenFirmware device tree (PowerPC only), PCI/AGP, CPUID (x86), IDE/ATA/ATAPI, PCMCIA (only tested on x86), SCSI and USB. -version Displays the version of lshw and exits.

What is the full path to the directory that contains log files, including secure, messages, [application], and kern.log?

/var/log The /var/log directory contains log files, including secure, messages, [application], and kern.log. /var/log/secure logs any attempts to log in as the root user or attempts to use the su command. /var/log/messages is the default file for storing system messages on systems running init. /var/log/[application] stores application specific log entries. /var/log/kern.log store kernel specific log entries.

faf

A crash collecting server, also known as the ABRT server. It provides accurate statistics of incoming reports and acts as a proxy in front of issue tracking software, such as bugzilla. It's designed to receive anonymous μReports and to find similar information among them. For known issues, it generates responses with links to faf's problem page, an issue tracker, or knowledge base entry.

libreport

A generic library that provides an API for reporting problems to different entities such as email, bugzilla, faf, scp upload, etc. By default, the notifications are sent to root at the local machine. You can use the conf file to change where notifications are sent.

logstash

A heavy-weight agent capable of performing more advanced processing and parsing. It is capable of obtaining data from a multitude of sources simultaneously, and after processing, it can then send it to your favorite "stash".

Buffer cache output

Buffers are used by programs with active I/O operations, i.e. data waiting to be written to disk. Cache is the result of completed I/O operations, i.e. buffers that have been flushed or data read from disk to satisfy a request.

CPU Monitoring and Configuration

CPU monitoring involves gathering information such as architecture, vendor name, model, number of cores, and speed of each core. The table below describes some of the Linux CLI commands you can use to monitor your CPU.

ForwardToSyslog

Configures journald to forward log messages to the traditional syslogd daemon.

abrt-cli remove <ID_OR_PATH>

Deletes a problem. e.g. abrt-cli remove aebfd1d843ec37f22e5c60d5d8002462c140e962 abrt-cli list remove /var/spool/abrt/ccpp

/var/log/firewall /var/log/firewalld

Depending on the distribution, the system stores log entries for the host firewall.

journalctl -u

Displays only log entries related to a specific service running on the system. e.g. journalctl -u ntpd Displays only journal messages relating to the ntpd daemon.

grep

Filters text from a text file. e.g. cat /var/log/messages | grep ftp filters the output of the cat command to show only lines that contain the term ftp.

gnome-abrt

GUI application for problem management and reporting.

11.1.2 Log File Facts

Log files can provide a system administrator with a wealth of information about how a Linux system is working. This lesson covers the following topics: Common log files Centralized logging

notifempty

Prohibits empty logs from being rotated.

abrt

The ABRT utility consists of a daemon and a collection of tools for handling crashes and monitoring logs for errors.

/tmp/install.log /root/install.log

The install.log may or may not be present, depending on the distribution. This file records messages related to the installation and can be useful for installation records for a computer.

/var/log/lastlog

The lastlog file holds information about the last time each user logged in.

11.1.5 journald Logging Facts

This lesson covers the following topics: Journald Configuration Commands to View the Journal

Linux systems that use SysVinit (init) use the syslogd daemon to manage logging. Which of the following daemons is used on newer system-based distributions to provide a local system log file? journald systemctl rsyslog syslog

journald Newer Linux distributions that are based on systemd do not use syslog anymore. Instead, they use the journald daemon to manage logging. Older init-based Linux distributions use the syslog daemon to manage system logging. rsyslog is a lightweight daemon that provides centralized logs. systemctl manages network services on systemd-based distributions. (journalctl is used to view the entire journal on system running journald.)

Which of the following commands manages, compresses, renames, and deletes log files based on a specific criteria such as size or date? logrotate dmesg lastlog logger

logrotate logrotate manages, compresses, renames, and deletes log files based on specific criteria (such as size or date). lastlog shows a list of the dates and times for the last login for each user. logger changes the message severity and where logged messages are sent. dmesg views the boot logs and troubleshoots hardware errors. The dmesg command shows information about all the hardware controlled by the kernel and displays error messages as they occur.

syslog-ng

syslog-ng collects logs from any source, process them in real time, and delivers them to a wide variety of destinations. syslog-ng also allows you to flexibly collect, parse, classify, rewrite and correlate logs from across your infrastructure and store or route them to log analysis tools.

Which of the following commands shows failed login attempts on the system? lastlog tail lastb sar

lastb lastb shows all failed login attempts on the system. lastlog shows a list of the dates and times for the last login for each user. sar views system statistics. tail shows the last 10 lines of a file

rsyslog

A light-weight daemon installed on most common Linux distributions. It offers fast high-performance, great security features, and a modular design. It is able to accept inputs from a wide variety of sources, transform them, and output the result to diverse destination. This is the most popular daemon.

11.1.7 Log File Display Facts

As a system administrator, you will encounter both binary and text-based log files. You should be familiar with working with both types of files. This lesson covers the following topics: Viewing and managing text-based log files Viewing and managing binary log files

11.2 Resource Monitoring

As you study this section, answer the following questions: How can you determine how long a system has been running? How can you view the details about the CPU cores? Which tool would you use to get an overview of the computer including status information for the CPU and memory? Which tool would you use to configure the kernel parameters at runtime? For what purpose would you use it? Which command would displays the total amount of free and used physical and swap memory in your computer? Which tool would extract detailed information on the hardware configuration of the machine? Which file contains the statistics about the memory usage? In this section, you will learn to: Determine a server's uptime. This section helps you prepare for the following certification exam objectives:

11.1 System Logging

As you study this section, answer the following questions: What is the role of the syslog daemon? What is the function of logrotate utility? Which commands can you use to view text-based log files? Which command show all failed login attempts on the system? In this section, you will learn to: Configure journald. View log files. This section helps you prepare for the following certification exam objectives:

dmesg -n #

Controls which error messages are sent to the console. For example, dmesg -n 1 sends only the most critical errors (0 and 1) to the console. Other messages are still logged in the log files.

create

Creates a log file with a name identical to the one just rotated. The command specifies the mode (permissions) of the file as well as the owner and group for the file. e.g. create 744 root root creates a file with read, write, and execute permissions for the owner and read permission for the group and everyone, specifies root as the file owner, and specifies root as the group.

abrt-cli list -d <ID_OR_PATH>

Displays detailed report data about a particular problem. e.g. abrt-cli list -d aebfd1d843ec37f22e5c60d5d8002462c140e962 abrt-cli list -d /var/spool/abrt/ccpp

uptime

Displays of the following information. Current time. How long the system has been running How many users are currently logged on System load averages for the past 1, 5, and 15 minutes. > Loads averages is a number that represents the average number of instructions waiting for CPU time. > A load average of 1 (for a single processor system CPU) means that the CPU is keeping up with the demand or is 100% utilized. > A load average of less than 1 indicates that the CPU is underutilized in other words it has perfect utilization. > Any number greater than 1 indicates that the CPU has been asked to do more than it can do in real time, and some tasks will have to wait for CPU time. > In multiprocessor systems, you use the same metrics multiplied by the number of processes. For example, a load average of 2 for a dual processor system indicates that the processors are keeping up with demand.

journalctl -f

Displays the last few entries in the journal. The journalctl command then monitors the journal and prints new entries as they are added. e.g. journalctl -f Displays the last few entries in the journal and then prints new entries as they are added.

postrotate

Indicates the start of script commands to be executed after log files are rotated. The term endscript must be used to indicate the end of the script.

Fluentd

Lets you unify the data collection and consumption for a better use and understanding of data. Fluentd tries to structure data as JSON as much as possible and has a flexible plug-in system that allows the community to extend its functionality.

Journald Configuration

Linux distributions based on the systemd daemon use the journald daemon for logging. *Distributions based on SysVinit (init) use the syslogd daemon to manage logging. The journald daemon maintains a system log called the journal, which is located in /var/log/journal/. The behavior of the journald daemon is configured in /etc/systemd/journald.conf. Some of the key configuration parameters in this file include the following:

abrt-cli list

Lists all crashes on a machine. *Before this command can be used, you may need to enable the autoreporting feature. To enable autoreporting, run: abrt-auto-reporting enabled abrt-cli list

/var/log/faillog /var/log/btmp

Login failures for user accounts are listed in either the faillog or btmp file, depending on the distribution.

logrotate

Manages, compresses, renames, and deletes log files based on specific criteria (such as size or date).

µReports

Micro reports, µReports, are small, machine readable reports used for automated reporting. They identify the operating system, versions of software running when the system crashed, information about the call stack at the time of the crash. a stack trace, or multiple stack traces in the case of multi-threaded programs. No private data. is allowed in the report.

retrace server

Provides dump analysis and backtrace generation service over a network using HTTP protocol. It is currently being merged to faf.

size

Rotates or remove log files based on file size as follows: size k specifies the size in kilobytes. size M specifies the size in megabytes. size G specifies the size in gigabytes. e.g. size 100M deletes or rotates files larger than 100 megabytes.

/var/log/sa

The /var/log/sa directory stores /sa[n] files, which contain all performance information for the day of the month indicated by [n]. For example, /var/log/sa/sa15 contains performance information for the fifteenth day of the month, and it will be overwritten on the fifteenth day of the next month.

Automatic Bug Reporting Tool (ABRT)

The Automatic Bug Reporting Tool (ABRT) is a tool that can be extremely helpful in troubleshooting a system crash. ABRT is a suite of tools that helps users detect, report, and resolve application crashes. ABRT analyzes the crash and takes steps to resolve the issue. When a system crash occurs, ABRT: Collects data about the system. Produces backtrace from the core dump. Automatically generates and send reports. Creates a bug ticket. Identifies and makes available knowledge base articles relevant to the problem. Identifies software updates that resolves the issue. The following table identifies ABRT components and their functions.

/var/log/cron

The cron file stores messages related to tasks scheduled with cron. It keeps track of which tasks are run and when they were started.

/var/log/dmesg

The dmesg file is often called the kernel ring buffer. It reports messages received in the process of configuring hardware devices as the system boots.

dmidecode

The dmidecode tool is used for dumping a computer's Desktop Management Interface (DMI) or SMBIOS table contents in a human-readable format. This table contains a description of the system's hardware components, as well as other useful pieces of information such as serial numbers and BIOS revision. Using this table, you can retrieve this information without having to probe for the actual hardware. While this is a good point in terms of report speed and safeness, this also makes the presented information possibly unreliable. While this is a good point in terms of report speed and safeness, this also makes the presented information possibly unreliable.

free

The free command displays the total amount of free and used physical and swap memory in your computer, as well as the buffers and caches used by the kernel. The information is gathered by parsing /proc/meminfo. Switches for the free command include the following: -b | -k | -m The -b switch displays the amount of memory in bytes; the -k switch (set by default) displays it in kilobytes; the -m switch displays it in megabytes. -t The -t switch displays a line containing the totals. -o The -o switch disables the display of a "buffer adjusted" line. If the -o option is not specified, free subtracts buffer memory from the used memory and adds it to the free memory reported. -s The -s switch activates continuous polling delay seconds apart. You may actually specify any floating point number for delay, usleep is used for microsecond resolution delay times. -l The -l switch shows detailed low and high memory statistics. -v The -V switch displays version information.

11.2.3 Resource Monitoring Facts

The goal of resource monitoring is to keep track of conditions on network resources and ensure those resources perform optimally. Monitoring will help you to identify problems, identify the source of those problems, identify situations that indicate potential problems, and identify resources that might need to be upgraded or changed. There are many tools available to help you monitor resources and ensure your entire system running smoothly. This lesson covers the following topics: Automatic Bug Reporting Tool (ABRT) ABRT tools and commands CPU monitoring and configuration Memory monitoring and configuration Tools to troubleshoot hardware issues

sar

The sar (System Activity Report) command is part of the sysstat package. The sar command reports cumulative values in the count and interval parameters of activity counters in the operating system. Example of information you can use sar to view is as follows: Collective CPU usage Individual CPU statistics Memory used and available Swap space used and available Overall I/O activities of the system Individual device I/O activities Network statistics Be aware of the following about the sar command: > Writes information the specified number of times spaced at the specified intervals in seconds. If the interval parameter is set to zero, the sar command displays the average statistics for the time since the system was started. If the interval parameter is specified without the count parameter, then reports are generated continuously. The collected data can also be saved in the file specified by the -o filename flag, in addition to being displayed onto the screen. If filename is omitted, sar uses the standard system activity daily data file, the /var/log/sa/sadd file, where the dd parameter indicates the current day. By default all the data available from the kernel are saved in the data file. > The sar command extracts and writes to standard output records previously saved in a file. This file can be either the one specified by the -f flag or, by default, the standard system activity daily data file. > Without the -P flag, the sar command reports system-wide (global among all processors) statistics, which are calculated as averages for values expressed as percentages, and as sums otherwise. If the -P flag is given, the sar command reports activity which relates to the specified processor or processors. If -P ALL is given, the sar command reports statistics for each individual processor and global statistics among all processors. > You can select information about specific system activities using flags. Not specifying any flags selects only CPU activity. Specifying the -A flag is equivalent to specifying -bBdqrRSvwWy -I SUM -I XALL -n ALL -u ALL -P ALL. > The default version of the sar command (CPU utilization report) might be one of the first facilities the user runs to begin system activity investigation, because it monitors major system resources. If CPU utilization is near 100 percent (user + nice + system), the workload sampled is CPU-bound. > If multiple samples and multiple reports are desired, it is convenient to specify an output file for the sar command. Run the sar command as a background process. The syntax for this is: sar -o datafile interval count >/dev/null 2>&1 & > All data is captured in binary form and saved to a file (datafile). The data can then be selectively displayed with the sar command using the -f option. Set the interval and count parameters to select count records at interval second intervals. If the count parameter is not set, all the records saved in the file will be selected. Collection of data in this manner is useful to characterize system usage over a period of time and determine peak usage hours. > Note: The sar command only reports on local activities.

/var/log/wtmp

The wtmp file keeps track of all users who have logged into and out of the system as well as listing every connection and runlevel change.

sysctl

This command lets you configure the kernel parameters at runtime. To view all of the available parameters, as root run sysctl -a. If needed, you can change one of these parameters which takes effect immediately, and if needed, the change can be written permanently using the -w switch. Example: sysctl -w kernel.sysrq="1" Keep in mind that there may not be any parameters that directly correlate to CPU usage, but instead, changing some parameters may have a direct impact on the CPU's performance. For example, tuning the network adapter by disabling the TCP timestamps option can result in better CPU utilization. This is really a powerful tool, so use it with care. There are a lot of kernel parameters that if changed could really mess your system up. Be sure to look at the man pages for sysctl before you start working with it, and be informed about any variable, and what it affects before changing the its value.

/proc/meminfo

This file reports statistics about memory usage on the system. It is used by the free command (see below) to report the amount of free and used memory (both physical and swap) on the system as well as the shared memory and buffers used by the kernel. Each line of the file consists of a parameter name, followed by a colon, the value of the parameter, and an option unit of measurement (e.g., "kB").

journalctl -b

Views system boot messages. The messages from the most recent system boot are displayed by default. To display message from a specific boot, use the following options with this command: > Specify a positive number to display messages from the specified system boot, starting from the beginning of the journal. > Specify a negative number to display messages from the specified system boot starting from the end of the journal. e.g. journalctl -b 2 Displays messages created during the second boot event from the beginning of the journal. journalctl -b -2 Displays messages created during the second boot event from the end of the journal.

sar

Views system statistics. sar is short for System Activity Report. It comes as part of the sysstat (System Statistics) package. When used alone, it returns CPU statistics. Common options include the following: -A displays all information. -b displays I/O statistics. -B displays swap statistics. -f /var/log/sa filename displays information from the specified file.

dmesg

Views the boot logs and troubleshoots hardware errors. The dmesg command shows information about all the hardware controlled by the kernel and displays error messages as they occur.

cat

Views the contents of a log file. e.g. cat /var/log/messages shows the entire text of the messages log.

journalctl

Views the entire journal. The output begins at the beginning of the journal and pauses one page at a time. To exit out of journalctl, press q e.g. journalctl Displays the journal, starting with the oldest entries.

Out of memory killer

When a Linux computer is critically low on memory, the Linux kernel uses the Out Of Memory Killer (OOM Killer) process to review all running processes and kill one or more of them in order to free up system memory and keep the system running. The Out Of Memory Killer works by reviewing all running processes and assigning them a badness score. The process that has the highest score is the one that is killed. The Out Of Memory Killer assigns a badness score based on a number of criteria, such as: > The process and its all of its child processes are using a lot of memory. > The minimum number of processes that need to be killed (ideally one) in order to free up enough memory to resolve the situation. > Root, kernel, and important system processes are given much lower scores. Viewing the system log is the best method used to determine if OOM Killer was that a program was killed. Another method is to run: dmesg | grep -i "killed process"

Memory Monitoring and Configuration

When working with computer memory, consider the following:

11.1.10 View Log Files

You are an IT manager. One of your job duties is monitoring system logs for the Linux systems on your network. The Journald service is collecting and storing system log data. In this lab, your task is to view the system logs using the journalctl command with the option that: Displays the kernel message log from the current boot. Displays the system log in reverse order with the newest entries first. Complete this lab as follows: At the prompt, type journalctl -k and press Enter. Type q to quit. Type journalctl -r and press Enter.

Commands to View the Journal

You can view the journal with the following commands:

To install ABRT and its utilities, run one or both of the following:

yum install abrt-cli This will install the ABRT daemon and tools for use from the command-line. yum install abrt-desktop This will install the ABRT Desktop (ABRT GUI interface). *The steps to install ABRT may be different depending on your distribution.