How can I add a separate syslogd log for a custom process

[Debbie Fleith]

I want to configure syslogd to capture custom messages to a separate log file than the other system messages are going to.

How do I configure syslog.conf to separate custom messages, and is there any other configuration needed?

[James R. Ferguson]

Hi Debbie:

Take a look at the man pages (1M) for 'syslogd'. The requirements, including the fact that a *tab* character is used to separate the 'action' and the 'selector' fields are well described, and the examples are good.

Regards!

...JRF...

[James R. Ferguson]

Hi (again) Debbie:

BTW, don't forget to look at 'logger' too ('man logger'). If you have a custom application, this is an ideal, programmatic interface to 'syslog'.

Regards!

...JRF...

[A. Clay Stephenson · Accepted solution]

Hi Debbie:

Modify the syslog configuration file (typically /etc/syslog.conf) and add a line something like this:
myprog.info /var/adm/syslog/myprog.log

This will log all info level and above messages from the myprog subsystem to myprog.log.

Man syslogd for details and instruction on how to force the reload of the configuration file.

Regards, Clay

[Sridhar Bhaskarla]

As far as my knowledge goes, you can only customize the logfiles based on the level of criticality or facility. You may not be able to use syslog to log into different files based on your criteria other than that is in /etc/syslog.conf. For ex., if you want your application to use syslogd but want all the messages related to a particular process in a seperate log file is not possible.

Even if you use logger, it is only an user interface for logging into syslog.log.

However, it is possible for you if your code uses one of the facilities like LOCAL0. Then you can modify your syslog.conf to specify a different log file for this facility.

-Sri

-Sri

[Debbie Fleith]

Clay,

Thanks for the example! If I use configure the myprog.info line in syslog.conf and restart syslogd, all I need to do is use the "-p myprog.info" parameter on my "logger" commands, and messages for myprog will go to the new log, right?

Will this custom log be auto-truncated like the default syslog logs?

[Sridhar Bhaskarla]

Not really Debbie. Unless your "myprog" is using a facility. Usually the applications can
use any one of LOCAL0-7 facilities. Let's say it used local0 facility, then you can configure local0.info (or .debug or whatever) in your syslog.conf and specify a seperate log file.

-Sri

[Debbie Fleith]

How do I know what facility my app is using, or do I have to configure that some how?

[Sridhar Bhaskarla]

You need to check with your application vendor. For ex., by default SSH uses the facility "0". If they are not using syslog to log their messages, it is not possible.

-Sri