Configuring System Messaging

Configuring System Messaging


The syslog system messaging features track system activities and events. You can manually generate log messages by using the logger command. The syslog function, the syslogd daemon, and input from the /etc/syslog.conf file work together to facilitate system messaging for the solaris 9 OE.

The /etc/syslog.conf file

This file consists of two tab-separated fields: selector and action. The selector field has two components, a facility and a level written as facility.level. Facility represent categories of system processes that can generate messages. Levels represent the severity or importance of the message. The action field determines whether to send the message.

*.err /var/adm/messages -- Error messages for all facilities are sent to the /var/adm/messages

Only use tabs as white space in the .etc.syslog.conf file. The Solaris OE accesses the /usr/include/sys/syslog.h file to determine the correct facility.level sequencing order.

Selector Fields (facility) Options

kern Messages generated by the kernel
user Messages generated by user processes and don’t have default priority for messages
daemon System daemon, such as the in.ftpd and the telnetd daemon
auth The authorization system, including the login, su, and ttymon commands
syslog Messages generated internally by the syslogd daemon
lpr The line printer spooling system, such as the lpr and lpc commands
news Files reserved for the USENET network news system
uucp The UNIX to UNIX copy (uucp) system does not use the syslog function
cron The cron and at facilities, including crontab, at, and cron
local0-7 Fields reserved for local use.
mark The time when the message was last saved and produced by the syslogd daemon
* All facilities, except the mark facility.

You can use the asterisk (*) to select all facilities (for eg. *.err); however, you cannot use * to select all levels of a facility (for eg. Kern.*)

The levels in descending order of severity
Selector Fields (level) Options
Level Priority Description

emerg 0 Panic conditions that are normally broadcast to all users
alert 1 Conditions that should be corrected immediately
crit 2 Warnings about critical conditions, such as hard device errors
err 3 Errors other than hard device errors
warning4 Warning messages
notice 5 Non-error conditions that might require special handling
info 6 Informational messages
debug 7 Messages that are normally used only when debugging a program
none 8 Messages are not sent from the indicated facility to the selected file

Not all levels of severity are implemented for all facilities in the same way.


Action Field -- The action field defines where to forward the message. This field can have any one of the following entries

/filename The targeted file
@host The @sign denoted that messages must be forwarded to a remote host.
Messages are forwarded to the syslogd daemon on the remote host
user1, user2 The user1 and user2 entries receive messages if they are logged in
* All logged in users will receive messages

You must restart the syslogd daemon whenever you make any changes to /etc/syslog.conf file
# /etc/init.d/syslog stop (or) start
# pkill –HUP syslogd

 Syslogd started -- It’s starting the M4 Macro Processor -- M4 will read the /etc/syslog.conf file.


Configuring syslog Messaging

The inetd daemon uses the syslog command to record incoming network connection requests made by using TCP. You can modify the behavior of the inetd daemon to log TCP connections by using the syslogd daemon. The daemon facility and the notice message level are supported by inetd.
Use the –t option as an argument to the inetd daemon to enable tracing of TCP services. When you enable the trace option for the inetd daemon, it uses the daemon.notice to log the client’s IP address and TCP port number, and the name of the service. Add the –t option to the entry which activated the inetd daemon in the inetsvc script located in the /etc/init.d directory

# grep inetd /etc/init.d/inetsvc
/usr/sbin/inetd –s –t -- You must restart the inetd daemon for the new option to take effect

# grep daemon.notice /etc/syslog.conf
*.err;kern.debug;daemon.notice;mail.crit /var/adm/messages

Monitoring a syslog File in Real Time

The tail –f command holds the file open so that you can view messages being written to the file by the syslogd daemon.

# tail –f /var/adm/messages -- Press Ctrl+c to exit


Adding One-Line Entries to a System Log File

logger [-i](logs PID) [-f file] [-p priority] [-t tag] [message]

# logger system rebooted -- If the user.notice field is configured in the /etc/syslog.conf file, the message is logged to the file designated for the user.notice selector field

# logger –p user.err system rebooted -- Changing the priority of the messages to user.err route the messages to the /var/adm/messages file as indicated in the /etc/syslog.conf file
# logger –i –p2 “crit”

/dev/sysmsg -- Console