configuring syslog.conf

[DECORSE Olivier]

Hello, i'm searching for documentations about configuring /etc/syslog.conf. Is there any document about it ?
I'm searching thinks like :
- this error from this process produce this alarm to the syslog process. For example : a scsi reset from the kernel produce a emergency alarm !!
Thank's a lot.
Olivier.

[S.K. Chan]

The man pages has some examples right at the very end ..
# man 1m syslogd

Also for more info ..
# man 3c syslog

After changes/modifications are made, remember to restart syslogd.

[Printaporn_1]

Hi,

Have you check manpage syslogd(1M) and syslog(3C)

[Mateja Bezjak]

Hi,

This link might be helpful:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xe8d328e43106d6118ff40090279cd0f9,00.html

Regards,
Mateja

[Steven Sim Kok Leong]

Hi,

# man 1m syslogd
# man 1 logger

Hope this helps. Regards.

Steven Sim Kok Leong

[Steve Steel · Accepted solution]

Hi


Try man syslogd


That should suffice.


This error from this process means you would need to look at all processes.

Messages are identified by facility and level. If special treatment is needed
for a specific message that is already being logged to syslog the facility and level of
the message must be found.

This can be done by running syslogd in
debug mode.

Run syslog in debug mode by killing the running syslogd daemon and starting it
with /usr/sbin/syslogd -d. This will result in a continuous scrolling
display to the terminal syslogd was just started from.

Look at the "pri" field in the output that scrolls to the screen. The first
character is the facility and the second is the level. The file
/usr/include/syslog.h contains the translations for the fields.

Ex


got a message (1, 0x8)
logmsg: pri 47, flags 0, from nitro, msg Apr 10 09:56:55 : LOGIN:
pam_authenticate error
readfds = 0x68 0x3 0x5 0x6


The facility is 4 so it equates to the following

#define LOG_AUTH (4<<3) /* security/authorization messages */

The facility for this message is "auth". The level is 7 which equates to
"debug". This was determined from the following line in syslog.h:


#define LOG_DEBUG 7 /* debug-level messages */

To send the message above to an extra file add the following lines to the syslog.conf file:


auth.debug /var/adm/authrequests.log
auth.debug /var/adm/syslog/syslog.log


Steve Steel