Configuring message logging

What message logging is

The storage system maintains messages in the /etc/messages file on its root volume.

The level of information that the storage system records in the /etc/messages file is configurable in the /etc/syslog.conf file.

Note
You should check the /etc/messages file once a day for important messages. You can automate the checking of this file by creating a script on the administration host that periodically searches /etc/messages and then alerts you of important events.

Where messages are sent

Message logging is done by a syslogd daemon. The /etc/syslog.conf configuration file on the storage system's root volume determines how system messages are logged. Depending on their severity and origin, messages can be sent to

The console
A file
A remote system

By default, all system messages (except those with debug-level severity) are sent to the console and logged in the /etc/messages file.

Accessing your message log files

You can access the /etc/messages files using your NFS or CIFS client, or using HTTP. For more information, see Accessing the default directories on the storage system.

The /etc/messages file restart schedule

Every Sunday at midnight, the /etc/messages file is copied to /etc/messages.0, the /etc/messages.0 file is copied to /etc/messages.1, and so on. The system saves messages for up to six weeks; therefore, you can have up to seven message files (/etc/messages.0 through /etc/messages.5 and the current /etc/messages file).

The /etc/syslog.conf file

The /etc/syslog.conf file consists of lines with two tab-separated (not space-separated) fields of the following form:

facility.level action

The facility parameter

The facility parameter specifies the subsystem from which the message originated. The following table describes the facility parameter keywords.

Keyword	Description
`auth`	Messages from the authentication system, such as `login`
`cron`	Messages from the internal `cron` facility
`daemon`	Messages from storage system daemons, such as `rshd`
`kern`	Messages from the storage system kernel
`*`	Messages from all facilities

The level parameter

The level parameter describes the severity of the message. The following table describes the level parameter keywords arranged in order from most to least severe.

Level	Description
`emerg`	Panic condition that causes a disruption of normal service
`alert`	Condition that you should correct immediately, such as a failed disk
`crit`	Critical conditions, such as disk errors
`err`	Errors, such as those caused by a bad configuration file
`warning`	Conditions that might become errors if not corrected
`notice`	Conditions that are not errors, but might require special handling
`info`	Information, such as the hourly uptime message
`debug`	Used for diagnostic purposes
`*`	All levels of errors

The action parameter

The action parameter specifies where to send messages. Messages for the specified level or higher are sent to the message destination. The following table describes the possible actions and gives examples of each action.

Action	Example
Send messages to a file specified by a path.	/etc/messages
Send messages to a host name preceded by an @ sign.	@adminhost
Send messages to the console.	/dev/console or *

Action

Example

Send messages to a file specified by a path.

/etc/messages

Send messages to a host name preceded by an @ sign.

@adminhost

Send messages to the console.

/dev/console

Sample /etc/syslog.conf file

The following example shows a customized /etc/syslog.conf file:

# Log anything of level info or higher to /etc/messages.

*.info                        /etc/messages



# Log all kernel messages of levels emerg, alert, crit,

# and err to /etc/messages.

kern.err                      /etc/messages



# Log all kernel messages, and anything of level err or

# higher to the console.

*.err;kern.*                  /dev/console



# Log all kernel messages and anything of level err or

# higher to a remote loghost system called adminhost.

*.err;kern.*                  @adminhost

# Log messages from the authentication system of level notice

# or higher to the /etc/secure.message file. This file has

# restricted access.

auth.notice                   /etc/secure.message

Configuring message logging

To configure message logging, complete the following steps.

Step	Action
1	Open the /etc/syslog.conf file with an editor from a client.
2	Add one or more lines using the following format: facility.level <tab> action For more information about these parameters, see The /etc/syslog.conf file.
3	Save and close the /etc/syslog.conf file. Result The changes you made to the syslog.conf file are read automatically and are reflected in the message logging.

Step

Action

Open the /etc/syslog.conf file with an editor from a client.

Add one or more lines using the following format:

facility.level <tab> action

For more information about these parameters, see The /etc/syslog.conf file.

Save and close the /etc/syslog.conf file.

Result

The changes you made to the syslog.conf file are read automatically and are reflected in the message logging.

For more information

For more information about the syslog.conf file, see the na_syslog.conf(5) man page.