Linux Syslog notes

Original article address

Linux diary system is monitored by system logsProgramSyslogd is composed of the kernel log monitor klogd. The two monitoring programs are both daemon and registered as system services. In other words, we can find the corresponding execution programs under the/etc/init. d/directory, and start, close, and restart them using the service command. The/etc/syslog. conf file is the configuration file of the Linux diary system. The following is the content of my/etc/syslog. conf file (/Etc/rsyslog. conf in Ubuntu):

 

2. # Log all kernel messages to the console. 
4. # Logging much else clutters up the screen. 
6. # Kern. */dev/console 
8.  
10. # Log anything (could t mail) of level info or higher. 
12. # Don't log private authentication messages!
14. *. Info; mail. None; authpriv. None; cron. None/var/log/messages
16.  
18. # The authpriv file has restricted access.
20. Authpriv. */var/log/secure
22.  
24. # Log all the mail messages in one place.
26. Mail. *-/var/log/maillog
28.  
30.  
32. # Log cron stuff
34. Cron. */var/log/cron
36.  
38. # Everybody gets emergency messages
40. *. Emerg *
42.  
44. # Save news errors of level crit and higher in a special file.
46. Uucp, news. crit/var/log/Spooler
48.  
50. # Save boot messages also to boot. Log
52. Local7. */var/log/boot. Log

 

Before explaining this configuration file in detail, let's take a look at how to use syslogs in Linux C programming.

Syslog APIs

Linux C provides a set of system log writing interfaces, including three functions: openlog, syslog, and closelog.

Openlog is optional. If openlog is not called, openlog is automatically called when syslog is called for the first time. You can also choose to call closelog, which only disables the descriptor used for communicating with the Syslog daemon.

The following is the call format of the three functions:

2. # Include <syslog. h>
4. VoidOpenlog (Char* Ident,IntOption,IntFacility );
6. VoidSyslog (IntPriority,Char* Format ,...);
8. VoidCloselog ();

 

Both openlog and closelog are optional. However, by calling openlog, we can specify the ident parameter at www.linuxidc.com. In this way, the ident will be added to each diary record. IDENT is generally set to the program name, for example, "testsyslog" in the following example ":

2. # Include <syslog. h>
6. IntMain (IntArgc,Char* Argv [])
8. {
10. Openlog ("Testsyslog", Log_cons | log_pid, 0 );
12. Syslog (log_user | log_info,"Syslog Test message generated in program % s \ n", Argv [0]);
14. Closelog ();
16. Return0;
18. }

 

After an executable file is compiled and run every time, the program adds the following record to/var/log/messages:

1. Apr 23 17:15:15 lirong-920181 testsyslog [27214]: syslog Test message generated in program./A. Out

 

The format is timestamp hostname ident [pid]: Log message. Ident indicates that we call openlog as the specified "testsyslog", and [27214] indicates that the option parameter of openlog specifies log_pid. The options, facility, and priority parameters in the syslog function are discussed in detail below.

According to the/usr/include/sys/syslog. h file, we can see that the options supported by syslog are as follows:

2. /* 
4. * Option flags for openlog. 
6. * 
8. * Log_odelay no longer does anything. 
10. * Log_ndelay is the inverse of what it used to be. 
12. */ 
14. # Define log_pid 0x01/* log the PID with each message */ 
16. # Define log_cons 0x02/* log on the console if errors in sending */ 
18. # Define log_odelay 0x04/* Delay open until first syslog () (default )*/ 
20. # Define log_ndelay 0x08/* Don't delay open */ 
22. # Define log_nowait 0x10/* don't wait for console forks: deprecated */ 
24. # Define log_perror 0x20/* log to stderr as well */

25. We can combine these options with operations. Syslog supports the following faclility:

    2. /* Facility codes */ 
    4. # Define log_kern (0 <3)/* kernel messages */ 
    6. # Define log_user (1 <3)/* random user-level messages */ 
    8. # Define log_mail (2 <3)/* Mail System */ 
    10. # Define log_daemon (3 <3)/* system daemons */ 
    12. # Define log_auth (4 <3)/* Security/authorization messages */ 
    14. # Define log_syslog (5 <3)/* messages generated internally by syslogd */ 
    16. # Define log_lpr (6 <3)/* Line Printer subsystem */ 
    18. # Define log_news (7 <3)/* Network News subsystem */ 
    20. # Define log_uucp (8 <3)/* uucp subsystem */ 
    22. # Define log_cron (9 <3)/* Clock daemon */ 
    24. # Define log_authpriv (10 <3)/* Security/authorization messages (private )*/ 
    26. # Define log_ftp (11 <3)/* FTP daemon */

    The correspondence between the facility ID (the value above) and the name is as follows:

    2. {"Auth", Log_auth },
    4. {"Authpriv", Log_authpriv },
    6. {"Cron", Log_cron },
    8. {"Daemon", Log_daemon },
    10. {"Ftp", Log_ftp },
    12. {"Kern", Log_kern },
    14. {"LPR", Log_lpr },
    16. {"Mail", Log_mail },
    18. {"Mark", Internal_mark },/* Internal */
    20. {"News", Log_news },
    22. {"Security", Log_auth },/* Deprecated */
    24. {"Syslog", Log_syslog },
    26. {"User", Log_user },
    28. {"Uucp", Log_uucp },

    This ing maps the facility ID in the syslog System Call to the configuration options in the syslog. conf file. I will explain it in detail later. Facility indicates the type of the syslog application to be called. Syslog supports the following priority:

    2. # Define log_emerg 0/* system is unusable */ 
    4. # Define log_alert 1/* action must be taken immediately */ 
    6. # Define log_crit 2/* critical conditions */ 
    8. # Define log_err 3/* error conditions */ 
    10. # Define log_warning 4/* warning conditions */ 
    12. # Define log_notice 5/* normal but significant condition */ 
    14. # Define log_info 6/* informational */ 
    16. # Define log_debug 7/* debug-level messages */

    The correspondence between the priority ID (the value above) and the name is as follows:

    2. {"Alert", Log_alert },
    4. {"Crit", Log_crit },
    6. {"Debug", Log_debug },
    8. {"Emerg", Log_emerg },
    10. {"Err", Log_err },
    12. {"Error", Log_err },/* Deprecated */
    14. {"Info", Log_info },
    16. {"None", Internal_nopri },/* Internal */
    18. {"Notice", Log_notice },
    20. {"Panic", Log_emerg },/* Deprecated */
    22. {"Warn", Log_warning },/* Deprecated */
    24. {"Warning", Log_warning },

    This ing works in the same way as facility to match the configuration options in the syslog. conf file. Priority is used to indicate the priority of a log, or to indicate the severity of the log time. In actual use, the priority parameter in the syslog function is actually a combination of the facility and priority mentioned above.

    Return to the syslog. CONF file and testsyslog program. Based on the previous analysis, we will study why testsyslog writes the log to the file/var/log/messages, rather than other files.

    The basic syntax of the syslog. conf file line is as follows:

    [Message Type (rule)] [processing scheme (diary file)]

    Note that the two must be separated by one or more TAB characters. The message type is composed of a message source (facility) and a priority (priority. For example, news. crit in the preceding syslog. conf file indicates the "critical" status from news. Here, news indicates the message source, and crit indicates the critical situation. Wildcard * indicates all message sources, such as the first rule :*. info: Send all messages above the info level (Notice, warning, err, alert, emerg) (Priority table) to the/var/log/messages log file. In the testsyslog program, the priority specified when the syslog function is called is log_user | log_info. According to the relationship between the ID and name mentioned above, the corresponding message type rule is user.info, contained in Rule *. info, so the log will be written to/var/log/messages.

    Modify the syslog. conf file

    In general, we want to be able to specify specific diary files for our applications. At this time, we need to modify the syslog. conf file. Suppose we want to write the debug log to the/var/log/debug file. The first step is to add the following message rules to the syslog. conf file as the first rule:

    1. User. debug/var/log/debug

    If the new rule takes effect, restart syslogd and klogd: Service syslog restart (/Etc/init. d/rsyslog restart in Ubuntu)

    To test whether the new rule takes effect, we can modify testsyslog as follows:

    2. # Include <syslog. h>
    6. IntMain (IntArgc,Char* Argv [])
    8. {
    10. Openlog ("Testsyslog", Log_cons | log_pid, 0 );
    12. Syslog (log_user | log_debug,"Syslog Test message generated in program % s \ n", Argv [0]);
    14. Closelog ();
    16. Return0;
    18. }

    After the execution file is compiled and generated, a new record is added to the/var/log/debug file every time it is run.