more to log in syslog?

[someone_4]

Is there anymore logging that you can turn on that will write more info into syslog or mail.log ? I notice some stuff goes to mail@root .. Is there more errors or event notice features that can be turned off and on?

Thanks
Richard

[A. Clay Stephenson]

Hi Richard,

The amount of error logging is not a function of syslogd but rather of the individual applications which are logging the errors. Each of those, typically, has a configuration file in which you specify the Logging Level.
e.g. in /etc/mail/sendmail.cf there is a Parameter called LogLevel which is typically set at 9; increase it (and restart the sendmail) and the level of logging goes up.

Clay

[Robin Wakefield]

Richard,

You need to look at your /etc/syslog.conf (man syslogd). Basically you can report log-enabled applications at various levels and higher to files, remote hosts, users, and so forth.

Rgds, Robin

[someone_4]

So if there is differnt level for differnt apps what are the best things to log or whatch out for ? Is there anything specific that I should turn up .. or are the defaults fine?
Im not worried about the logs filling up I have a nice cron job that moves them and compresses them. I just want to make sure I am watchin everything that I need to watch.

Richard

[A. Clay Stephenson · Accepted solution]

Hi Richard,

In general, I leave the values for syslog.conf at default. The setting are usually very reasonable unless you are looking for specific problems and indeed most of the logging levels are reasonable in the subsystems like mail.

I generally avoid changing any of these so that my ITO templates which monitor syslog.log do not have to be modified depending on which hosts that are applied. Of course, if you need more logging data then by all means crank it it and allow syslog to log messages of all types. One thing you might be interested in doing is setting the -l option on inetd to log each connection. I warn you that that puppy grows very quickly.

Clay

[someone_4]

Thanks for the advice there. I just want to make sure that im watchin everything that I need to watch.

Richard