topic Re: configuring syslog.conf in Operating System - HP-UX

configuring syslog.conf

DECORSE Olivier — Thu, 07 Mar 2002 08:55:13 GMT

Hello, i'm searching for documentations about configuring /etc/syslog.conf. Is there any document about it ?
I'm searching thinks like :
- this error from this process produce this alarm to the syslog process. For example : a scsi reset from the kernel produce a emergency alarm !!
Thank's a lot.
Olivier.

Re: configuring syslog.conf

S.K. Chan — Thu, 07 Mar 2002 09:05:09 GMT

The man pages has some examples right at the very end ..
# man 1m syslogd

Also for more info ..
# man 3c syslog

After changes/modifications are made, remember to restart syslogd.

Re: configuring syslog.conf

Printaporn_1 — Thu, 07 Mar 2002 09:05:55 GMT

Hi,

Have you check manpage syslogd(1M) and syslog(3C)

Re: configuring syslog.conf

Mateja Bezjak — Thu, 07 Mar 2002 09:10:39 GMT

Hi,

This link might be helpful:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xe8d328e43106d6118ff40090279cd0f9,00.html

Regards,
Mateja

Re: configuring syslog.conf

Steven Sim Kok Leong — Thu, 07 Mar 2002 09:12:46 GMT

Hi,

# man 1m syslogd
# man 1 logger

Hope this helps. Regards.

Steven Sim Kok Leong

Re: configuring syslog.conf

Steve Steel — Thu, 07 Mar 2002 09:13:23 GMT

Hi

Try man syslogd

That should suffice.

This error from this process means you would need to look at all processes.

Messages are identified by facility and level. If special treatment is needed
for a specific message that is already being logged to syslog the facility and level of
the message must be found.

This can be done by running syslogd in
debug mode.

Run syslog in debug mode by killing the running syslogd daemon and starting it
with /usr/sbin/syslogd -d. This will result in a continuous scrolling
display to the terminal syslogd was just started from.

Look at the "pri" field in the output that scrolls to the screen. The first
character is the facility and the second is the level. The file
/usr/include/syslog.h contains the translations for the fields.

Ex

got a message (1, 0x8)
logmsg: pri 47, flags 0, from nitro, msg Apr 10 09:56:55 : LOGIN:
pam_authenticate error
readfds = 0x68 0x3 0x5 0x6

The facility is 4 so it equates to the following

#define LOG_AUTH (4<<3) /* security/authorization messages */

The facility for this message is "auth". The level is 7 which equates to
"debug". This was determined from the following line in syslog.h:

#define LOG_DEBUG 7 /* debug-level messages */

To send the message above to an extra file add the following lines to the syslog.conf file:

auth.debug /var/adm/authrequests.log
auth.debug /var/adm/syslog/syslog.log

Steve Steel