Message logging

About message logging

The filer maintains messages in the /etc/messages file on the root volume.

The level of information that the filer records in the /etc/messages file is configurable.

About the syslogd daemon and the /etc/syslog.conf file

The message logging daemon, syslogd, uses the /etc/syslog.conf configuration file on the filer root volume to determine how to log system messages.

You can configure syslogd to direct system messages to the console, to a file, or to a remote system based on their severity and origin.

By default, all system messages (except for those of severity level debug) are written to the console and to the /etc/messages file on the root volume.

The /etc/syslog.conf file format

The /etc/syslog.conf file consists of lines with two tab-separated (not space-separated) fields of the following form:

facility.level action

The facility parameter

The facility parameter specifies the subsystem from which the message originated. The following table describes the facility parameter keywords.


Keyword	Description
`auth`	messages from the authentication system, such as login
`cron`	messages from the internal `cron` facility
`daemon`	messages from filer daemons, such as `rshd`
`kern`	messages from the filer kernel
`*`	messages from all facilities

The level parameter

The level parameter describes the severity of the message. The following table describes the level parameter keywords arranged in order from highest to lowest severity.


Level	Description
`emerg`	panic condition that causes a disruption of normal service
`alert`	condition that you should correct immediately, such as a failed disk
`crit`	critical conditions, such as disk errors
`err`	errors, such as those caused by a bad configuration file
`warning`	conditions that might become errors if not corrected
`notice`	conditions that are not errors, but might require special handling
`info`	information, such as the hourly uptime message
`debug`	used for diagnostic purposes (suppressed by default)
`*`	specifies all levels

The action parameter

The action parameter specifies where messages should be sent. Messages for the specified level or higher are sent to the message destination. The following table describes the possible actions and gives examples of each action.


Action	Example
Send messages to a file specified by a path.	/etc/messages
Send messages to a host name preceded by an @ sign.	@adminhost
Send messages to the console.	/dev/console or *

Example line from /etc/syslog.conf

The following example causes all kernel messages of levels emerg, alert, crit, and err to be sent to the /etc/messages file:

err.kern /etc/messages

The /etc/messages file restart schedule

Every Sunday at midnight, the /etc/messages file is copied to /etc/messages.0, the /etc/messages.0 file is copied to /etc/messages.1, and so on. The system saves messages for up to six weeks.

Checking the /etc/messages file daily

Check the /etc/messages file once a day for important messages. You can automate checking this file by creating a script on the administration host that periodically searches /etc/messages and then alerts you.

Sample /etc/syslog.conf file

The following example shows a customized /etc/syslog.conf file:

 # Log anything of level info or higher to /etc/messages.

 *.info                        /etc/messages

 # Log all kernel messages, and anything of level err or

 # higher to the console.

 *.err;kern.*                  /dev/console

 # Log all kernel messages and anything of level err or

 # higher to a remote loghost system called adminhost.

 *.err;kern.*                  @adminhost

 # Log messages from the authentication system of level notice

 # or higher to the /etc/secure.message file. This file has

 # restricted access.

 auth.notice                   /etc/secure.message

For more information

For more information about the syslog.conf file, see the na_syslog.conf(5) man page.

Part No. 210-02334
File: routin17.htm
Last updated: 02/24/99 12:15:49