1 System Logging - syslog and /var/log/Index

System technicians need to know what is happening on the system, and Linux provides an extensive logging system. The logging handles logs generated by the Linux kernel and by other processes.

Logging of program and system messages is handled by a syslog process, a process that listens for connections and writes messages to log files.

System logging is configured via files in /etc such as /etc/syslog.conf, /etc/rsyslog.conf, etc. The syslog process is started by system start-up scripts such as klogd, sysklogd, rsyslogd, etc. The main daemon (program) name is usually something like “syslogd” or “rsyslogd” or “klogd”.

$ ps laxww | grep syslog
$ ps laxww | grep klogd

Logs are usually stored under directory /var/log/; but, the configuration file for the syslog program can put the files anywhere. A useful command to use is one that shows which log files have changed recently, using the “time” option to ls:

$ ls -lt /var/log | less

• logging needs a system log daemon running to receive log messages:
  • the daemon is started via a Run Level script such as /etc/init.d/rsyslog
  • to find the logging script, try:  $ ls -ld /etc/init.d/*log*
• syslog uses a config file, e.g. /etc/syslog.conf or maybe /etc/rsyslog.conf
  • to find the config file, try:  $ ls -ld /etc/*log*
• the config file assigns types of logging to various file names
  • usual syslog log file directory:  /var/log/*
• know how to find out where the logs are kept!

Author: 
| Ian! D. Allen  -  idallen@idallen.ca  -  Ottawa, Ontario, Canada
| Home Page: http://idallen.com/   Contact Improv: http://contactimprov.ca/
| College professor (Free/Libre GNU+Linux) at: http://teaching.idallen.com/
| Defend digital freedom:  http://eff.org/  and have fun:  http://fools.ca/