topic Re: syslog facility code "P" in Operating System - HP-UX

syslog facility code "P"

Mark Landin — Wed, 22 Jan 2003 15:47:36 GMT

We are seeing messages in our syslog file with facility code P. Looking at the man page, there is no facility defined for that code. So what is it? We're on 11.11 btw.

(These messages are coming from a Cisco router. We'd like to send these messages to another log file by modifying syslog.conf, but I need to know the facility NAME for the code of P so I can add the proper line to syslog.conf)

Any ideas?

Re: syslog facility code "P"

Mark Landin — Thu, 23 Jan 2003 16:53:51 GMT

*bump*

Surely someone will accept the challenge....

Re: syslog facility code "P"

Bill McNAMARA_1 — Thu, 23 Jan 2003 16:55:55 GMT

attach the message!

Later,
Bill

Re: syslog facility code "P"

James R. Ferguson — Thu, 23 Jan 2003 17:13:46 GMT

Hi Mark:

For grins-and-giggles, see if your '/usr/include/syslog.h' offers any definition.

Regards!

...JRF...

Re: syslog facility code "P"

Mark Landin — Thu, 23 Jan 2003 17:20:14 GMT

Bill,

Attached are two sample syslog messages.

James,

It says "messages thru 15 are reserved for system use" then begins listing codes for Q thru Z.

Re: syslog facility code "P"

Chris Wilshaw — Thu, 23 Jan 2003 17:30:59 GMT

Looking at the section 3C syslog manpage, I have

LOG_KERN A
LOG_USER B
LOG_MAIL C
LOG_DAEMON D
LOG_AUTH E
LOG_SYSLOG F
LOG_LPR G
LOG_NEWS H
LOG_UUCP I
LOG_CRON J
LOCAL0-7 Q-X

This is on 11.11 with patch PHCO_23413

The latest patch is PHCO_27772 (link below), but the document doesn't mention a facility code of P

http://www4.itrc.hp.com/service/patch/patchDetail.do?patchid=PHCO_27772&context=hpux:800:11:11

What patch level are you on?

Re: syslog facility code "P"

Mark Landin — Thu, 23 Jan 2003 17:33:30 GMT

PHCO_26522

Re: syslog facility code "P"

James R. Ferguson — Thu, 23 Jan 2003 17:34:36 GMT

Hi (again) Mark:

Patch PHCO_23251 (contained in PHCO_24915) offers this note"

( SR:8606165810 CR:JAGad35101 )
Man page to describe all the level and facilities provided by syslogd.

You might try downloading PHCO_24915 and installing it, or if you prefer, simply downloading and tar-extracting the man page (usr/share/man/man3.Z/syslog.3c).

I suspect that "P" is "Priority".

Regards!

...JRF...

Re: syslog facility code "P"

Mark Landin — Thu, 23 Jan 2003 17:46:27 GMT

James,

Are you implying then that I can add a line like:

Priority.* /tmp/cisco.log

to syslog.conf to get these messages sent to a different log file? That's what I'm after, ultimately...

Re: syslog facility code "P"

James R. Ferguson — Thu, 23 Jan 2003 17:48:50 GMT

Hi Mark:

I'm saying that downloading the patch and extracting is quick and may provide the definition you require.

Regards!

...JRF...

Re: syslog facility code "P"

Bill Hassell — Thu, 23 Jan 2003 20:04:12 GMT

There is no such facility 'P' syslogd defines the known facilities and priorities but the syslog entry does not indicate either the facility or priority used by the router. The code P is probably the encoded code mentioned in the man page for syslog:

Priority:
LOG_EMERG 0
LOG_ALERT 1
LOG_CRIT 2
LOG_ERR 3
LOG_WARNING 4
LOG_NOTICE 5
LOG_INFO 6
LOG_DEBUG 7

Facility:
LOG_KERN A
LOG_USER B
LOG_MAIL C
LOG_DAEMON D
LOG_AUTH E
LOG_SYSLOG F
LOG_LPR G
LOG_NEWS H
LOG_UUCP I
LOG_CRON J
LOCAL0-7 Q-X

Note that code K thru P are undefined and from the strings inside syslogd, it looks like there would be an error message when an undefined facility or priority name was used.

To find out what facility and priority code is being used, syslogd must be restarted with the -v option. This can be done by manually killing syslogd and restarting with: /usr/sbin/syslogd -D -v
or permanently changed by editing /etc/rc.config.d/syslogd and then using the standard /sbin/init.d/syslogd stop (and then start).

The entries in the log file(s) will now look like:

Jan 23 14:59:02 4B:h60 TestMessage from logger

In this case, 4b:h60 means:

4=warn
B=user
h60=hostname

Leaving the -v option turned on is not a bad idea as you select new files to sort out the messages.

Re: syslog facility code "P"

Bill Hassell — Fri, 24 Jan 2003 00:39:00 GMT

Here's a quick script that will decode the facility/priority codes something like this:

Jan 23 14:58:57 SYSLOG:INFO syslogd: restart
Jan 23 14:59:02 USER:WARNING myTag: Message from logger
Jan 23 18:27:28 DAEMON:INFO xntpd[905]: synchronized to ...
Jan 23 19:33:05 LOCAL5:INFO ftpd[13926]: FTP LOGIN FROM ob6000 ...

Re: syslog facility code "P"

Mark Landin — Fri, 24 Jan 2003 14:12:12 GMT

Bill,

Thanks for the script.

I've decided my best bet is to figure out if I can get the Cisco gear generating these syslog messages to use a facility code bewtween Q and Z, so I can then do something useful in syslog.conf with those messages. A facility code of P just isn't going to be usable.

Thanks for all who helped...

Re: syslog facility code "P"

Chris Wilshaw — Fri, 24 Jan 2003 14:47:08 GMT

Looking into things further;

The Cisco router should be configured to use your HP server as the syslog server with the command

logging XXX.XXX.XXX.XXX

where XXX... is the IP address of the HP server.

Normally, Cisco equipment transmits its messages as type "Local7", which would give them a facility code of X. This suggests to me that either there is some issue in the config on the router, or possibly something unusual about the IOS release that is loaded on it.

Re: syslog facility code "P"

Mark Landin — Tue, 28 Jan 2003 22:06:38 GMT

Thanks! I'll see if we can get our Cisco back it's "default" behavior of X, not P.