1822147 Members
4118 Online
109640 Solutions
New Discussion юеВ

syslog facility code "P"

 
SOLVED
Go to solution
Mark Landin
Valued Contributor

syslog facility code "P"

We are seeing messages in our syslog file with facility code P. Looking at the man page, there is no facility defined for that code. So what is it? We're on 11.11 btw.

(These messages are coming from a Cisco router. We'd like to send these messages to another log file by modifying syslog.conf, but I need to know the facility NAME for the code of P so I can add the proper line to syslog.conf)

Any ideas?
14 REPLIES 14
Mark Landin
Valued Contributor

Re: syslog facility code "P"

*bump*

Surely someone will accept the challenge....
Bill McNAMARA_1
Honored Contributor

Re: syslog facility code "P"

attach the message!

Later,
Bill
It works for me (tm)
James R. Ferguson
Acclaimed Contributor

Re: syslog facility code "P"

Hi Mark:

For grins-and-giggles, see if your '/usr/include/syslog.h' offers any definition.

Regards!

...JRF...
Mark Landin
Valued Contributor

Re: syslog facility code "P"

Bill,

Attached are two sample syslog messages.

James,

It says "messages thru 15 are reserved for system use" then begins listing codes for Q thru Z.
Chris Wilshaw
Honored Contributor

Re: syslog facility code "P"

Looking at the section 3C syslog manpage, I have

LOG_KERN A
LOG_USER B
LOG_MAIL C
LOG_DAEMON D
LOG_AUTH E
LOG_SYSLOG F
LOG_LPR G
LOG_NEWS H
LOG_UUCP I
LOG_CRON J
LOCAL0-7 Q-X

This is on 11.11 with patch PHCO_23413

The latest patch is PHCO_27772 (link below), but the document doesn't mention a facility code of P

http://www4.itrc.hp.com/service/patch/patchDetail.do?patchid=PHCO_27772&context=hpux:800:11:11

What patch level are you on?
Mark Landin
Valued Contributor

Re: syslog facility code "P"

PHCO_26522
James R. Ferguson
Acclaimed Contributor

Re: syslog facility code "P"

Hi (again) Mark:

Patch PHCO_23251 (contained in PHCO_24915) offers this note"

( SR:8606165810 CR:JAGad35101 )
Man page to describe all the level and facilities provided by syslogd.

You might try downloading PHCO_24915 and installing it, or if you prefer, simply downloading and tar-extracting the man page (usr/share/man/man3.Z/syslog.3c).

I suspect that "P" is "Priority".

Regards!

...JRF...

Mark Landin
Valued Contributor

Re: syslog facility code "P"

James,

Are you implying then that I can add a line like:

Priority.* /tmp/cisco.log

to syslog.conf to get these messages sent to a different log file? That's what I'm after, ultimately...
James R. Ferguson
Acclaimed Contributor

Re: syslog facility code "P"

Hi Mark:

I'm saying that downloading the patch and extracting is quick and may provide the definition you require.

Regards!

...JRF...
Bill Hassell
Honored Contributor

Re: syslog facility code "P"

There is no such facility 'P' syslogd defines the known facilities and priorities but the syslog entry does not indicate either the facility or priority used by the router. The code P is probably the encoded code mentioned in the man page for syslog:

Priority:
LOG_EMERG 0
LOG_ALERT 1
LOG_CRIT 2
LOG_ERR 3
LOG_WARNING 4
LOG_NOTICE 5
LOG_INFO 6
LOG_DEBUG 7

Facility:
LOG_KERN A
LOG_USER B
LOG_MAIL C
LOG_DAEMON D
LOG_AUTH E
LOG_SYSLOG F
LOG_LPR G
LOG_NEWS H
LOG_UUCP I
LOG_CRON J
LOCAL0-7 Q-X

Note that code K thru P are undefined and from the strings inside syslogd, it looks like there would be an error message when an undefined facility or priority name was used.

To find out what facility and priority code is being used, syslogd must be restarted with the -v option. This can be done by manually killing syslogd and restarting with: /usr/sbin/syslogd -D -v
or permanently changed by editing /etc/rc.config.d/syslogd and then using the standard /sbin/init.d/syslogd stop (and then start).

The entries in the log file(s) will now look like:

Jan 23 14:59:02 4B:h60 TestMessage from logger

In this case, 4b:h60 means:

4=warn
B=user
h60=hostname

Leaving the -v option turned on is not a bad idea as you select new files to sort out the messages.


Bill Hassell, sysadmin
Bill Hassell
Honored Contributor

Re: syslog facility code "P"

Here's a quick script that will decode the facility/priority codes something like this:

Jan 23 14:58:57 SYSLOG:INFO syslogd: restart
Jan 23 14:59:02 USER:WARNING myTag: Message from logger
Jan 23 18:27:28 DAEMON:INFO xntpd[905]: synchronized to ...
Jan 23 19:33:05 LOCAL5:INFO ftpd[13926]: FTP LOGIN FROM ob6000 ...


Bill Hassell, sysadmin
Mark Landin
Valued Contributor

Re: syslog facility code "P"

Bill,

Thanks for the script.

I've decided my best bet is to figure out if I can get the Cisco gear generating these syslog messages to use a facility code bewtween Q and Z, so I can then do something useful in syslog.conf with those messages. A facility code of P just isn't going to be usable.

Thanks for all who helped...
Chris Wilshaw
Honored Contributor
Solution

Re: syslog facility code "P"

Looking into things further;

The Cisco router should be configured to use your HP server as the syslog server with the command

logging XXX.XXX.XXX.XXX

where XXX... is the IP address of the HP server.

Normally, Cisco equipment transmits its messages as type "Local7", which would give them a facility code of X. This suggests to me that either there is some issue in the config on the router, or possibly something unusual about the IOS release that is loaded on it.
Mark Landin
Valued Contributor

Re: syslog facility code "P"

Thanks! I'll see if we can get our Cisco back it's "default" behavior of X, not P.