Introduction to Linux syslog and introduction to linuxsyslog

Introduction to Linux syslog and introduction to linuxsyslog

I. Introduction

Syslog is the default log daemon process in Linux. The default main configuration files and auxiliary configuration files are/etc/syslog. conf and/etc/sysconfig/syslog. Generally, syslog receives information from various functions of the system. Each information includes important levels. The/etc/syslog. conf file notifies syslogd how to report information based on the device and Information Importance level.

 

Ii. Configuration File

The/etc/syslog. conf file is configured in the following format:

facility.level    action

Description: facility. level is the selection condition. It is divided into two fields and separated by a decimal point. Action and facility. level are separated by tabs.

Facility message type, which specifies the syslog function, mainly including:

Kern kernel information is first transmitted through klogd; user process; mail; daemon background process; authpriv authorization information; syslog System Log; lpr printing information; news group information; the information cron plan and task information generated by uucp. The internal function of mark syslog is used to generate a timestamp local0 ---- local7 and a custom program. For example, use local5 as the ssh function.

* Wildcard represents all functions except mark

Level message level, which specifies the syslog priority, mainly including:

Emerg or panic this system is unavailable (the most urgent message) conditions that alert needs to be modified immediately (the urgent message) crit blocks error conditions (important messages) implemented by some tools or subsystems) the error condition (error message) warning information (warning message) notice implemented by the err blocking tool or some subsystem functions is a common condition of importance (common but important messages) info-provided message (notification message) debug does not contain function conditions or other information about the problem (debugging-most information) none has no importance level, usually used for troubleshooting (no log messages are recorded) * all levels except none

Action domain, including:

/Var/log/lastlog: records the time each user recently checked in to the system.

/Var/run/utmp: records the time each user logs in to the system. who, users, finger, and other commands will query this file. /var/log/wtmp: records the time each user logs in and out. The last command will check this file. this file also records shutdown and reboot operations. /var/log/secure: information about the logon system/var/log/maillog: records sendmail, pop, and other related information. /var/log/cron: records information about crontab. The timer information/var/log/dmesg:/bin/dmesg will display this file, it is the screen message at startup. /var/log/xferlog: records the addresses used by ftp to retrieve those files. /var/log/messages: Most messages of the system are recorded here, including login, check password, failed login, ftp, and su.

 

Iii. programming example

http://blog.chinaunix.net/uid-25120309-id-3359929.html