Essential System Administration Pocket Reference

System Messages and Log Files

File locations

syslog daemon configuration file

Usual:

/etc/syslog.conf

General message log file

Usual:	/var/log/messages
HP-UX:	/var/adm/syslog/syslog.log
Solaris:	/var/adm/messages

syslog subsystem configuration

FreeBSD:	/etc/rc.conf: syslogd_enable and syslogd_flag.
Linux:	/etc/sysconfig/syslog (SuSE): SYSLOGD_PARAMS and KERNEL_LOGLEVEL.

/etc/syslog.conf file format

facility[,facility].level[;facilities.level] dest

Facility is a list of one or more defined syslog “facilities,” which are sources of system messages. Multiple facilities are separated by commas.

Level is a defined message severity level; all messages at that level and higher will be selected.

Multiple facility-level pairs may be listed, separated by semicolons. An asterisk may be used for either item; the asterisk refers to all facilities or all severity levels, except mark.

The final item is the message destination; it can be a full pathname to a file, a user or list of users to whom a message should be sent (* refers to all logged-in users), or @hostname (forward it to the syslog daemon on that host). Note that specified files must already exist.

Facilities

kern	The kernel.
user	User processes.
mail	The mail subsystem.
lpr	The printing subsystem.
daemon	System server processes.
auth	The user authentication system (nonsensitive information).
authpriv	The user authentication system (security sensitive information). Some systems have only one of auth ...