Linux log mechanism syslogd summary

1. the composition structure of BSDsyslogd: it can be seen that the relevant log files mainly come from three ways: (1) kernel: many kernel routines call the log function to generate log messages, in addition, the klogd daemon can listen to and receive kernel messages and send them to the syslogd process. (2) many applications...

1. Structure of BSD syslogd:

The log files can be viewed in three ways:

(1) kernel:

Many kernel routines call the log function to generate log messages. In addition, the klogd daemon can listen to and obtain kernel messages and send them to the syslogd process.

(2) many user processes directly call the syslog function to generate log messages.

(3) log messages from TCP/IP network connections. The message may come from a user process or a user process on another network host. Port is 514.

We mainly discuss the log messages generated in the second case. Syslog-related functions are as follows:

Openlog:

Ident is mainly used in log messages and is generally replaced by a program name. Such as cron and inetd.

Option is the bit blocking of many options. the common options are shown in the following table:

The purpose of setting the facility parameter is to process messages of different facilities in different ways through the configuration file. Common facility is shown in the following table:

Openlog ("dhcp6c", LOG_NDELAY | LOG_PID, LOG_DAEMON );

Syslog:

The priority parameter can be a combination of facility and level. The value of level can be as follows:

Syslog (LOG_ERR, "open error for % s: % m", filename)

Syslog (LOG_ERR | LOG_LPR, "open error for % s: % m", filename)

Format is a formatted error message string.

 

Setlogmask: used to set the log record priority, that is, only log messages with the specified priority are recorded.

Setlogmask (LOG_ERR) ----- only records ERR-level log messages

Setlogmask (LOG_UPTO (LOG_ERR) ----- record ERR and all previous log messages

 

Syslogd configuration file: (/etc/syslog. conf)

Mainly used to control how to handleFacility | priorityLog messages, such as stored in a specified file or sent to the specified log server,

2. display of kernel message logs and log level of the printk function:

As you can see from the previous-1, the function printk first prints the message to the _ logbuf in the ring buffer and sends the message to the console for display, the console driver then displays log messages based on the log level of the console.

The following table lists common log levels:(The lower the number, the higher the level !)

Several Constants related to the log level:

# Defineconsole_loglevel (console_printk [0]) indicates the log level of the console. messages with a higher priority will be displayed on the console. Its initial value is default_lele_loglevel. this value can be modified through klogd-cn (n is the set level), but note that the klogd process must be killed before modification. # Define default_message_loglevel (lele_printk [1]) default message log level. this value is used when printk does not define a priority. # define minimum_lele_loglevel (console_printk [2]) minimum console log level, minimum value that can be set for the console log level # define default_console_loglevel (lele_printk [3]) default console log level, which can be modified by calling sys_syslog. Ps: You can view and modify the four constant values through the/proc/sys/kernel/printk file. You can modify the current log level in the following ways:

Echo 8>/proc/sys/kernel/printk

[Extension] the fprintf function can output the result to a specified stream, such as stdout, stderr, and stdin, or a specific file stream.


From Chen lilong's column