sendmail, 4th Edition

syslog(3)

The syslog(3) facility uses two items of information to determine how to handle messages: facility and level. The facility is the category of program issuing a message. The syslog facility can handle many categories, but only one, mail, is used by sendmail. The level is the degree of severity of the warnings. The sendmail program issues messages with syslog(3) at various levels depending on how serious the message or warning is.

When sendmail first starts to run, it opens its connection to the syslog facility with the following C-language line:

openlog("sendmail", LOG_PID, LOG_MAIL);       ← prior to V8.10
openlog(SM_LOG_STR, LOG_PID, LOG_MAIL);       ← V8.10 and later

This tells syslog three things:

• Unless told otherwise with the -L command-line switch (-L on page 243), all messages should be printed using sendmail as the name of the program doing the logging. This means that regardless of what name is used to run sendmail (such as newaliases or smtpd), the name that is logged will always be either sendmail or a name you specify. To specify a different name, with V8.10 or above, just define the SM_LOG_STR compile-time macro when building sendmail:

  define(`SM_LOG_STR', `smtpd')

• The LOG_PID tells syslog that the PID (process identification number) should be included when each message is written. This is necessary because sendmail forks often, and each parent and child will have a different PID. Because queue file identifiers are constructed from PIDs, this record helps to determine which ...