Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

syslog

|

407

Configuring syslog

Whenever syslogd, the syslog daemon, receives a log message, it acts based on the

message’s type (or “facility”) and its priority. syslog’s mapping of actions to facilities

and priorities is specified in /etc/syslog.conf. Each line in this file specifies one or

more facility/priority selectors followed by an action; a selector consists of a facility

or facilities and a (single) priority.

In the following syslog.conf line in Example 12-1,

mail.notice is the selector and /var/

log/mail

is the action (i.e., “write messages to /var/log/mail”).

Within the selector,

mail is the facility (message category) and notice is the level of

priority.

What About klogd?

One daemon you probably won’t need to reconfigure but should still be aware of is

klogd, Linux’s kernel log daemon. This daemon is started automatically at boot time

by the same script that starts the general system logger (probably /etc/init.d/syslogd or

/etc/init.d/sysklogd, depending on which Linux distribution you use).

By default, klogd directs log messages from the kernel to the system logger, which is

why most people don’t need to worry about klogd: you can control the handling of ker-

nel messages by editing the configuration file for syslogd.

This is also true if you use Syslog-ng instead of syslog,