The workhorse of the Linux logging system is the system logging
With Windows NT, each system maintains its own log files. There is no central
location where they are all stored. Although the Event Viewer can access
event logs on other machines, this can often take a
great deal of time especially when there are a lot of entries and you have a
slow connection.
Instead,
Another advantage is due to the fact that
Part of this ability lies in the standard format of each log entry. Although it is possible that a rogue program could write information in any order, all system daemons and most programs follow the standard, which is:
Here “system” is the
As you can see, even if you could not separate the log entries into different files, it would be fairly easy to separate them using a script.
Configuring syslogd
What is done and when it is done is determined by
the
The selector portion is itself broken into two parts, which are separated by a dot. The facility part says what aspect of the system is to be recorded and the priority says what level of messages to react to. The selector has the general syntax:
You can see a list of facilities in table 1 and a list of the priorities in
table 2.
Table 1
authpriv
cron
daemon
kern
lpr
mail
mark
news
security
syslog
user
uucp
local0 through local7.
The facility “security” should no longer be used and the “mark” facility is used internally and should not be used within applications. The facilities local0 through local8 are intended for local events on you local system when there is no other applicable facility.
Table 2 – Syslogd Priorities in increasing significance
debug
info
notice
warning or warn
err or error
crit
alert
emerg or panic
The priorities error, warn and
For both facilities and priorities there is a “wildcard” that can be used (an asterisk – *) which means any facility or any priorities. For example, *.emerg would mean all emergency messages. mail.* would mean all messages coming from the mail facility. Logically, *.* means all priorities of messages from all facilities.
The word “none” is used to refer to no priority for the specified facility.
For example, the selector mail.none would say not to perform the action for
any mail
Another possibility is to specify a sub-set of facilities, rather than all of them. This is done by separating the facilities with a comma and then the priority follows the last facility listed. For example, to refer to information messages for mail, uucp and news, the selector entry would look like this:
One thing I need to point out here is that when you specify a priority, you are actually specifying everything at that priority or *higher*. Therefore, in this example, we are selecting all of the priorities at info and higher.
There are three primary things you can do with these events (the actions). Probably the most common action is to write them to a file. However, there is more to this than it appears. Remember that Linux (as well as other UNIX dialects) treat devices as files. Therefore, you can send the logging messages to a specific device.
Here, I not talking about sending them to a tape drive (although that might not
be a bad idea). Instead, I am talking about something like the system console
(
When writing to files, you want to consider that the system will actually
write the information to the disk with each
If overall system performance becomes an important factor in regard to
logging, you can tell syslogd not to
If you disable syncing the log file like this, one important thing to remember
is that you stand the chance of losing information. If the system goes down
for some reason before the information is written to the file, you may lose
an important clue as to why the system went down. One solution would be to
have a central log server where all of the information is sent and where you
do not disable syncing. That way no matter what, you have a record of what
happened.
Sending the log messages to another machine is done by using an at-sign (@) in front of the machine name as the action. For example:
This sends all emergency message to the machine logserver. I would suggest that you do not create a log server that is connected to the Internet. A ill-intended person might be able to bring the system to a halt or at least affect its performance by flooding it with erroneous log messages.
Another useful feature is the ability to send messages to named pipes. This
is done by preceding the name of the
Another action is the ability to send notification messages to particular users, provided they are logged in at the moment. To do this you simply put their username as the action. To send it to multiple users, separate the names by a comma. This might give you something like this:
Note that you could create an action that generates an email message which the user receives if they are logged in or not. However, that is not what we are talking about here.
By using an asterisk in place of the list of user names, you can send a message to everyone logged in.
In some cases, you want multiple actions for a specific facility or priority. This is no problem. You simply create multiple rules. One common example is broadcasting all of the emergency messages to every user, as well as writing them to a log file and sending them to another server in case the local machine crashes. This might be done like this:
*.emerg *
*.emerg @logserver
Previously, I mentioned the ability to cause a single action based on the same kind of messages for multiple facilities. This is still an example of a single selector resulting in a specific action. Taking this one step further, you might want multiple selectors all to result in a specific action. Although it could be done with multiple rules, it possible to have multiple selectors all on the same line. This is done by separating the selectors with a semi-colon (;).
This would notify the users root and jimmo for all emergency messages as well
as critical messages from the
The Linux syslogd has added a couple of functions that are not available in
other versions of
You can also explicitly exclude priorities by preceding them with an exclamation mark. Note that this will exclude the priorities listed as well as anything higher. You can combine the equal-sign and exclamation mark equal-sign and exclamation mark and therefore exclude a specific priority. If you do so, you need to precede the equal sign with the exclamation mark as what you are saying is not to include anything that equal a particular priority.
All of these features can be combined in many different ways. For example, you can have multiple selectors, which include as well as exclude specific priorities. For example:
This would send warning messages from all priorities to the system console terminal /dev/tty7, plus the mail log messages at only the info priority, no printer messages at all, and finally excluding just the uucp critical messages. Granted this is a rather contrived example, but it does show you how complex you can get.
Note that multiple selectors on a single line can cause some confusion when there are conflicting components within a selector. The thing to keep in mind is that the last component takes precedence. In the previous example, we specified warning messages for all facilities and then “overwrote” portions of that for the mail, lpr and uucp facilities.
Most system are configured by default to send a number of system messages
Software Requirements:
Configuration Requirements:
Prerequisites:
Skills Taught:
Ability to create Logrotate-entries.
Software Requirements:
Configuration Requirements:
Prerequisites:
Skills Taught:
Ability to create Logrotate-entries based on the size of the log file.