A logging system needs a standard way to report events, a lingua franca for log messages. That standard, for most of us, is syslog. There are several advantages to syslog. It is the primary event-reporting mechanism used by all legacy Linux applications, and it is well known and understood. In conjunction with the kernel logging daemon, klogd, syslog captures kernel and other system log messages that you may want to make visible to the appliance user.
This section describes how syslog works, how to use it in your applications, and how to configure its message filters. We give enough detail that you should have no trouble using syslog as the basis for your logging system.
6.3.1. syslog Architecture
Messages from syslog are generated in ...