Configuring message and event logging

What message logging is

The filer maintains messages in the /etc/messages file on the filer's root volume.

The level of information that the filer records in the /etc/messages file is configurable in the /etc/syslog.conf file.

What event logging is

The filer maintains a log of system events in the /etc/log/ems file on the filer's root volume. For more information about configuring event logging and the filer's Event Management System (EMS) mechanisms, see the na_ems(1) man page.

Where messages are sent

Message logging is done by a syslogd daemon. The /etc/syslog.conf configuration file on the filer's root volume determines how system messages are logged. Depending on their severity and origin, messages can be sent to

The console
A file
A remote system

By default, all system messages (except those with debug-level severity) are sent to the console and logged in the /etc/messages file.

The /etc/messages file restart schedule

Every Sunday at midnight, the /etc/messages file is copied to /etc/messages.0, the /etc/messages.0 file is copied to /etc/messages.1, and so on. The system saves messages for up to six weeks; therefore, you can have up to seven message files (/etc/messages.0 through /etc/messages.5 and the current /etc/messages file).

Checking the /etc/messages file daily

You should check the /etc/messages file once a day for important messages. You can automate the checking of this file by creating a script on the administration host that periodically searches /etc/messages and then alerts you.

The /etc/syslog.conf file format

The /etc/syslog.conf file consists of lines with two tab-separated (not space-separated) fields of the following form:

facility.level action

The facility parameter

The facility parameter specifies the subsystem from which the message originated. The following table describes the facility parameter keywords.

Keyword	Description
`auth`	Messages from the authentication system, such as login
`cron`	Messages from the internal `cron` facility
`daemon`	Messages from filer daemons, such as `rshd`
`kern`	Messages from the filer kernel
`*`	Messages from all facilities

The level parameter

The level parameter describes the severity of the message. The following table describes the level parameter keywords arranged in order from most to least severe.

Level	Description
`emerg`	Panic condition that causes a disruption of normal service
`alert`	Condition that you should correct immediately, such as a failed disk
`crit`	Critical conditions, such as disk errors
`err`	Errors, such as those caused by a bad configuration file
`warning`	Conditions that might become errors if not corrected
`notice`	Conditions that are not errors, but might require special handling
`info`	Information, such as the hourly uptime message
`debug`	Used for diagnostic purposes
`*`	All levels of errors

The action parameter

The action parameter specifies where to send messages. Messages for the specified level or higher are sent to the message destination. The following table describes the possible actions and gives examples of each action.

Action	Example
Send messages to a file specified by a path.	/etc/messages
Send messages to a host name preceded by an @ sign.	@adminhost
Send messages to the console.	/dev/console or *

Action

Example

Send messages to a file specified by a path.

/etc/messages

Send messages to a host name preceded by an @ sign.

@adminhost

Send messages to the console.

/dev/console

Sample /etc/syslog.conf file

The following example shows a customized /etc/syslog.conf file:

# Log anything of level info or higher to /etc/messages.

*.info                        /etc/messages



# Log all kernel messages of levels emerg, alert, crit,

# and err to /etc/messages.

kern.err                      /etc/messages



# Log all kernel messages, and anything of level err or

# higher to the console.

*.err;kern.*                  /dev/console



# Log all kernel messages and anything of level err or

# higher to a remote loghost system called adminhost.

*.err;kern.*                  @adminhost

# Log messages from the authentication system of level notice

# or higher to the /etc/secure.message file. This file has

# restricted access.

auth.notice                   /etc/secure.message

Configuring message logging

To configure message logging, complete the following steps.

Step	Action
1	Open the /etc/syslog.conf file with an editor from a client.
2	Add one or more lines using the following format: facility.level <tab> destination
3	Save and close the /etc/syslog.conf file.

Step

Action

Open the /etc/syslog.conf file with an editor from a client.

Add one or more lines using the following format:

facility.level <tab> destination

Save and close the /etc/syslog.conf file.

For more information

For more information about the syslog.conf file, see the na_syslog.conf(5) man page.