|
|
1.1 root 1: .TH SYSLOG 8
2: .\" @(#)syslog.8 4.2 7/28/83
3: .UC 4
4: .SH NAME
5: syslog \- log systems messages
6: .SH SYNOPSIS
7: /etc/syslog [
8: .BI \-m N
9: ] [
10: .BI \-f name
11: ] [
12: .B \-d
13: ]
14: .SH DESCRIPTION
15: .I Syslog
16: reads a datagram socket
17: and logs each line it reads into a set of files
18: described by the configuration file
19: /etc/syslog.conf.
20: .I Syslog
21: configures when it starts up
22: and whenever it receives a hangup signal.
23: .PP
24: Each message is one line.
25: A message can contain a priority code,
26: marked by a digit in angle braces
27: at the beginning of the line.
28: Priorities are defined in
29: .RI < syslog.h >,
30: as follows:
31: .IP LOG_ALERT \w'LOG_WARNING'u+2n
32: this priority should essentially never
33: be used. It applies only to messages that
34: are so important that every user should be
35: aware of them, e.g., a serious hardware failure.
36: .IP LOG_SALERT
37: messages of this priority should be
38: issued only when immediate attention is needed
39: by a qualified system person, e.g., when some
40: valuable system resource dissappears. They get
41: sent to a list of system people.
42: .IP LOG_EMERG
43: Emergency messages are not sent to users,
44: but represent major conditions. An example
45: might be hard disk failures. These could be
46: logged in a separate file so that critical
47: conditions could be easily scanned.
48: .IP LOG_ERR
49: these represent error conditions, such as soft
50: disk failures, etc.
51: .IP LOG_CRIT
52: such messages contain critical information,
53: but which can not be classed as errors, for example,
54: `su' attempts.
55: Messages of this priority and higher
56: are typically logged on the system console.
57: .IP LOG_WARNING
58: issued when an abnormal condition has been
59: detected, but recovery can take place.
60: .IP LOG_NOTICE
61: something that falls in the class of
62: ``important information''; this class is informational
63: but important enough that you don't want to throw
64: it away casually.
65: Messages without any priority assigned to them
66: are typically mapped into this priority.
67: .IP LOG_INFO
68: information level messages. These messages
69: could be thrown away without problems, but should
70: be included if you want to keep a close watch on
71: your system.
72: .IP LOG_DEBUG
73: it may be useful to log certain debugging
74: information. Normally this will be thrown away.
75: .PP
76: It is expected that the kernel will not log anything below
77: LOG_ERR priority.
78: .PP
79: The configuration file is in two sections
80: separated by a blank line.
81: The first section defines files that
82: .I syslog
83: will log into.
84: Each line contains
85: a single digit which defines the lowest priority
86: (highest numbered priority)
87: that this file will receive,
88: an optional asterisk
89: which guarantees that something gets output
90: at least every 20 minutes,
91: and a pathname.
92: The second part of the file
93: contains a list of users that will be
94: informed on SALERT level messages.
95: For example, the configuration file:
96: .nf
97:
98: 5*/dev/console
99: 8/usr/spool/adm/syslog
100: 3/usr/adm/critical
101:
102: eric
103: kridle
104: kalash
105:
106: .fi
107: logs all messages of priority 5 or higher
108: onto the system console,
109: including timing marks every 20 minutes;
110: all messages of priority 8 or higher
111: into the file /usr/spool/adm/syslog;
112: and all messages of priority 3 or higher
113: into /usr/adm/critical.
114: The users ``eric'', ``kridle'', and ``kalash''
115: will be informed on any subalert messages.
116: .PP
117: The flags are:
118: .TP 0.5i
119: .B \-m
120: Set the mark interval to
121: .I N
122: (default 20 minutes).
123: .TP
124: .B \-f
125: Specify an alternate configuration file.
126: .TP
127: .B \-d
128: Turn on debugging (if compiled in).
129: .PP
130: To bring
131: .I syslog
132: down,
133: it should be sent a terminate signal.
134: It logs that it is going down
135: and then waits approximately 30 seconds
136: for any additional messages to come in.
137: .PP
138: There are some special messages that cause control functions.
139: ``<*>N'' sets the default message priority to
140: .I N.
141: ``<$>'' causes
142: .I syslog
143: to reconfigure
144: (equivalent to a hangup signal).
145: This can be used in a shell file run automatically
146: early in the morning to truncate the log.
147: .PP
148: .I Syslog
149: creates the file
150: /etc/syslog.pid
151: if possible
152: containing a single line
153: with its process id.
154: This can be used to kill or reconfigure
155: .I syslog.
156: .\".PP
157: .\".I Syslog
158: .\"can also be compiled to use
159: .\".IR mpx (2)
160: .\"files instead of datagrams
161: .\"if you are running V7.
162: .\"In this case it creates and reads the file
163: .\"/dev/log.
164: .SH FILES
165: /etc/syslog.conf \- the configuration file
166: .br
167: /etc/syslog.pid \- the process id
168: .\".br
169: .\"/dev/log \- under V7, the mpx file
170: .SH BUGS
171: LOG_ALERT and LOG_SUBALERT messages
172: should only be allowed to privileged programs.
173: .PP
174: Actually,
175: .I syslog
176: is not clever enough to deal with kernel error messages
177: in the current implementation.
178: .SH SEE\ ALSO
179: syslog(3)
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.