Syslog
lastmod 2023-11-15created 2016-06-1512 edits
A log is a record of a system's operation, failures, and so on, and since it provides clues for troubleshooting, it is very important in system administration.
Most UNIX systems run a daemon called syslog, which receives messages from the kernel and system applications (the cron daemon, SMTP daemons such as sendmail, etc.). It can also record messages from the syslog daemons of remote hosts on the network using TCP/IP. syslog is a specification defined in an RFC (Request for Comments), and any implementation based on it can send messages not only from Linux servers but also from routers.
A message recorded in the log contains the date, host, sender, and message on a single line. By default it is stored as a text file, but it can also be stored in an RDBMS such as PostgreSQL or MySQL and edited later using tools.
Recorded content
You can see the date, host name, tag name, and message in that order.
RFC 3164 'The BSD syslog Protocol', which defines syslog, defines three parts: PRI, HEADER, and MSG.
The PRI part contains an integer representing the facility and priority. These two variables are said to be explained later.
In applications that actually implement syslog, such as rsylog and syslogd, this PRI part is omitted and the HEADER and MSG parts are recorded.
The Header part contains the date and host name.
syslog adopts a client/server model. syslogd, the server that records logs, starts by setting up the UNIX domain socket /dev/log. On the side of the application, the client that sends the messages to be recorded, the syslog function is used to send messages to the syslogd server via /dev/log.
Facility
- auth/security : for authentication (4, 10, 13, 14)
- authpriv : private authentication messages
- cron : cron, etc. (9, 15)
- daemon : daemons with no facility specified (3)
- kern : kernel (0)
- ipr : printer (6)
- mail : mail server (2)
- news : news server (7)
- syslog : syslog daemon (5)
- user : for user processes (1)
- uucp : for UUCP (8)
- local[0-7] : 7 for arbitrary use (16~23)
Priority
- debug : debug level (7)
- info : informational level (6)
- notice : notice level (5)
- warning/warn : warning level (4)
- error/err : fault, error level (3)
- crit : critical level (2)
- alert : alert level (1)
- emerg/panic : emergency (0)
Log level
See loglevel.
See also
- logger
- Log file (Log level; Logging)
- angle-grinder - A viewer that can parse, aggregate, sum, average, min/max, and sort logs in real time - enables simple yet sophisticated analysis when graphite/kibana/honeycomb/splunk etc. are not available
- LogFX - A multi-platform open-source log viewer
- tailspin - A log file highlighter