Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

412

|

Chapter 12: System Log Management and Monitoring

Suppose we want emergency messages broadcast to all logged-in users, as well as

written to their respective application logs. We could use something like

Example 12-5.

Did you notice the - (minus) sign in front of the write-to-file actions? This tells sys-

logd not to synchronize the specified logfile after writing a message that matches that

line. Skipping synchronization decreases disk utilization and thus improves perfor-

mance, but it also increases the chances of introducing inconsistencies, such as miss-

ing or incomplete log messages, into those files. Use the minus sign, therefore, only

in lines that you expect to result in numerous or frequent file writes.

Besides performance optimization, Example 12-5 also contains some useful redun-

dancy. Kernel warnings plus all messages of error-and-higher priority, except auth-

priv messages, are printed to the X-console window. All messages having priority of

emerg and higher are, too, in addition to being written to the screens of all logged-in

users.

Furthermore, all mail messages and kernel messages are written to their respective

logfiles. All messages of all priorities (except mail messages of any priority) are writ-

ten to /var/log/messages.

Example 12-5 was adapted from the default ...