1 System Logging – syslog and /var/log/

System technicians need to know what is happening on the system, and Linux provides an extensive logging system. The logging handles logs generated by the Linux kernel and by other processes.

Logging of program and system messages is handled by a syslog process, a process that listens for connections from system programs and writes the messages it receives into log files.

System logging is configured via files in /etc such as /etc/syslog.conf, /etc/rsyslog.conf, etc. The syslog process is started by system start-up scripts such as klogd, sysklogd, rsyslogd, etc. The main daemon (program) name is usually something like syslogd or rsyslogd or klogd.

$ ps laxww | grep syslog
$ ps laxww | grep klogd

Logs are usually stored under directory /var/log/; but, the configuration file for the syslog program can put the files anywhere. A useful command to use is one that shows which log files have changed (been modified) recently, using the “time” option to ls:

$ ls -lt /var/log | less

• logging needs a system log daemon running to receive log messages:
  • the daemon is started via a Run Level script such as /etc/init.d/rsyslog
  • to find the logging script, try:  $ ls -ld /etc/init.d/*log*
• syslog uses a config file, e.g. /etc/syslog.conf or maybe /etc/rsyslog.conf
  • to find the config file, try a GLOB pattern match: $ ls -ld /etc/*log*
• the config file assigns types of logging to various file names
  • usual syslog log file directory:  /var/log/*
• know how to find out where the logs are kept!

Author: 
| Ian! D. Allen, BA, MMath  -  idallen@idallen.ca  -  Ottawa, Ontario, Canada
| Home Page: http://idallen.com/   Contact Improv: http://contactimprov.ca/
| College professor (Free/Libre GNU+Linux) at: http://teaching.idallen.com/
| Defend digital freedom:  http://eff.org/  and have fun:  http://fools.ca/