"logger" command and KERN facility

[Jorge Fabregas]

Hell everyone,

I'm having a hardtime trying to figure out this. This is one of my lines in /etc/syslog.conf:

kern.debug /var/adm/syslog/kern/07-debug


I restart the syslog daemon and when I do this:

logger -p kern.debug "this is a test"

I don't see the message in 07-debug. I even stop/start syslogd so it will flush its buffers but still don't see anything.

The logger man page says:

"Messages written in locales other than the POSIX/C locale are not supported."

Does that mean that I can only use the logger command to test the ONLY the local facility?

Thanks,
Jorge

[Bill Hassell]

Once you make changes to syslog.conf, be sure to signal syslogd to re-read the /etc/syslog.conf file (no reboot or stop/start needed):

kill -HUP $(cat /var/run/syslog.pid)

The warning about locales has to do with languages, not the local facility. It simply means that logger does not have NLS (Native Langage Support). Run the command:

locale -a

to see all the language sets available. When a facility and priority have been defined (kern.debug), all higher priorities will be logged too. You can see the actual priorities and facilities by using the attached script and turning on the -v option for syslogd. To set syslogd options, edit the file /etc/rc.config.d/syslogd:

SYSLOGD_OPTS="-D -v"

then stop and restart syslogd with the start/stop script:

/sbin/init.d/syslogd stop
/sbin/init.d/syslogd start

Then use logger:

logger -p kern.debug "Test debug"
logger -p kern.info "Test info"

And check /var/adm/syslog/kern/07-debug for the messages, and use the attached script to read the file:

syslogdecoder /var/adm/syslog/kern/07-debug

[Jorge Fabregas]

Hi,

Thanks for the answer. I used that script about a year ago. I really like it. Thanks :)

I'm still having problems with syslog. I sent the SIGHUP signal so it would reread the conf file...However when I do:

logger -p kern.info "this is info"

it is not written to the specified location in /etc/syslog.conf. The funny part is that it is actually written to
/var/adm/syslog/user/06-info (the location specified for user.info events).

Any idea?

Thanks,
Jorge

[Jorge Fabregas]

I'm uploading my syslog.conf. As you may see, it may look like a stupid syslog.conf. You see, I'm trying to learn what's get written by what facility (and what severity) ...I want to deal with it for a couple of months (just to get familiar with it) and THEN later I'll resume mostly everything in a couple of files...( perhaps I end up with the original syslog.conf) ...


Jorge

[Bill Hassell · Accepted solution]

In your syslog.conf file:

#KERN FACILITY
kern.debug /var/adm/syslog/kern/07-debug
kern.info /var/adm/syslog/kern/06-info
kern.notice /var/adm/syslog/kern/05-notice
kern.warning /var/adm/syslog/kern/04-warning

The syslogd priority is a lower limit. Thus, the 06-kern.info file will have info plus notice, warn, err, crit, alert and emerg all sent to the 06-info file. The debug level will have all the messages sent to it.

However, at 11.11, I do see a strange behavior with the KERN facility and logger. It seems that using logger to generate a KERN, the messages are tagged with USER, not KERN facility, yet facilities MAIL and DAEMON seem to work OK. This may be a bug in logger. Try your other facility logging files with logger and my guess is that they may work OK.

[Jorge Fabregas]

Thanks Bill!

I'm glad that to know that you took the time to test it on your system. And in fact, yes, I did it on my 4 servers and I can see it works with other facilitiees ( I tried MAIL and it worked just like you said). The problem is with the kernel facility.

One last question before closing the thread: Do you think I should open a ticket regarding this (perhaps it is a bug)?

Many thanks!
Jorge

[Bill Hassell]

I don't see anything restricted in the logger man page about KERN, so it probably is a bug--or if not, the reason needs to be listed in the man page. There has been a recent patch for logger but it doesn't mention facility problems. I'd open a call with HP.

[Jorge Fabregas]

Got what I needed to know.