customize syslog logging

[Philip J. Priest_1]

I have /etc/syslog.conf like this:

*.err;*.crit;*.emerg /var/adm/syslog/critical.log

I have a shell script that will parse this file. I am looking for things that would be major problems.

Is this going to give me what im looking for?
What are other sysadm's doing for something like this?

thanks!
Phil

[Uday_S_Ankolekar]

in syslog.conf add this line
local7 /directory/filename (Where ou want to write)



And restart syslogd daemon

-USA..

[Philip J. Priest_1]

Uday what is local7?

thanks!
Phil

[Uday_S_Ankolekar]

That is to capture customized meassages, a varialble from [1-7] can be used. man syslogd for more information

-USA..

[Mel Burslan · Accepted solution]

Phil,

even better, check this page about the syslog.conf details explained a little more detailed than the syslogd man page:

http://www.scrambler.net/syslog.htm

[Uday_S_Ankolekar]

It should be...

local7.info /outputdir/filename
local7.warn /outputdir/filename
local7.err .... like this you can add

-USA..

[Geoff Wild]

local0-7 are facilitys in syslog.

So, developers can write their code to log to them - instead of the default syslog...

Example, ftp can be set to log to local5:

local5.info;mail.none /var/adm/syslog/ftpd.log

ssh can go to local6:

local6.debug /var/adm/syslog/sshd.log


etc...

Codes are in /usr/include/syslog.h



Rgds...Geoff

[Philip J. Priest_1]

Geoff, how do i customize the localX? i want to know in my log file anything of error and above.

thanks!
Phil

[Bill Costigan]

If you are planning to use one of the locals then the application writing to syslog has to know to use that local number.

For example, I've configured network switches and firewalls to write throught the syslog facility on HPUX using one of the locals, I have to tell the switch [in its syslog config section] to use local0 and the IP address of the 9000 and to log everything at a warning level or higher.

I can then configure syslogd to log all events for local0 (the network stuff) to /var/adm/syslog/network_stuff.log.

From your original question, it sounds like you are trying to get messages that would normally go to syslog but with a warning level or above to go to a special file that your script can parse. If so then you wouldn't use the local stuff, but would follow your original approach.

It wasn't clear from your message if you were getting entries in critical.log or not.
It sounded like you were but wanted to know which messages should cause you concern. Is that correct?

[Philip J. Priest_1]

Yes bill, i am getting messages in /var/adm/syslog/critical.log i have tested this with logger.

i have a line like this:
*.err;*.crit;*alert;*.emerg /var/adm/syslog/critical.log

i think this is all i need.

phil

[Bill Costigan]

That's good. I think you should be all set.
As far as the script, if you are going to do some sort of alerting when you get a message, I would start off alerting for every message and then modify the script to ignore just those messages that you determine to be not important.

That way you will not miss a critical message that you forgot to look for in your script.