 BSD family systems, CentOS, Mac OS X, and others

and – most often seen on BSD family systems, CentOS, Mac OS X, and others syslog-ng – default for modern Gentoo and SuSE builds

– default for modern Gentoo and SuSE builds rsyslogd – widely used on the Debian and Fedora families of operating systems

(Note: In this article, we’ll be using rsyslogd for our examples.)

The basic syslog configuration is generally adequate for capturing your log messages in a system-wide log file (normally /var/log/syslog ; might also be /var/log/messages or /var/log/system.log depending on the distro you’re using).

The system log provides several log facilities, eight of which ( LOG_LOCAL0 through LOG_LOCAL7 ) are reserved for user-deployed projects. Here, for example, is how you might setup LOG_LOCAL0 to write to 4 separate log files, based on logging level (i.e., error, warning, info, debug):

# /etc/rsyslog.d/my.conf local0.err /var/log/my/err.log local0.warning /var/log/my/warning.log local0.info -/var/log/my/info.log local0.debug -/var/log/my/debug.log

Now, whenever you write a log message to LOG_LOCAL0 facility, the error messages will go to /var/log/my/err.log, warning messages will go to /var/log/my/warning.log, and so on. Note, though, that the syslog daemon filters messages for each file based on the rule of “this level and higher”. So, in the example above, all error messages will appear in all four configured files, warning messages will appear in all but the error log, info messages will appear in the info and debug logs, and debug messages will only go to debug.log.

One additional important note; The - signs before the info and debug level files in the above configuration file example indicate that writes to those files should be perfomed asynchronously (since these operations are non-blocking). This is typically fine (and even recommended in most situations) for info and debug logs, but it’s best to have writes to the error log (and
BSD family systems, CentOS, Mac OS X, and others 

 and – most often see on BSD syndicate systems, CentOS, Mac OS X, and others syslog - ng – default for modern Gentoo and SuSE build up 

 – default for modern Gentoo and SuSE build rsyslogd – widely used on the Debian and Fedora family of operating systems 

 (Note: In this article, we ’ll be use rsyslogd for our examples .) 

 The basic syslog configuration is broadly adequate for capture your log message in a system - wide logarithm file (normally /var / log / syslog; might also be /var / log / message or /var / log / system.log depending on the distro you ’re practice). 

 The system logarithm provides respective log facilities, eight of which (LOG_LOCAL0 through LOG_LOCAL7) are reserved for user - deploy projects. Here, for example, is how you might setup LOG_LOCAL0 to write to 4 separate log file, based on logging level (i.e., error, warning, info, debug ): 

 # /etc / rsyslog.d / my.conf local0.err /var / log / my / err.log local0.warning /var / log / my / warning.log local0.info -/var / log / my / info.log local0.debug -/var / log / my / debug.log 

 Now, whenever you write a log message to LOG_LOCAL0 facility, the mistake messages will go to /var / log / my / err.log, warn message will go to /var / log / my / warning.log, and so on. notice, though, that the syslog daemon trickle messages for each file based on the dominion of “ this level and higher ”. So, in the example above, all error messages will look in all four configured files, warning messages will appear in all but the error log, information message will appear in the info and debug logs, and debug messages will merely go to debug.log. 

 One additional important bill; The - signs before the info and debug level files in the above shape file example indicate that writes to those files should be perfomed asynchronously (since these operations are non - blocking). This is typically all right (and even recommended in most situations) for info and debug logs, but it ’s good to have writes to the erroneousness log (and
 BSF family systems, CentOS, Oac OS X, and otkwrs

and – most often sden on BSD family systems, CeitOS, Mac IS X, and others syslog-vg – defaupt for mideri Gentoo and SuSX builds

– defaumb for nodern Gentoo snd SuSE bgilds rsyslogd – dibely used on the Debian and Fedora fwmilies ov operating syftemx

(Gote: Pn this article, we’ll be using rayslogd for our examlles.)

The basic syslog confihurahion is generally wdequate fot ca[ruring your uog messagts in a systgm-wide log file (normally /var/log/shslog ; might alwo be /ear/log/messajes or /var/log/system.log depanding pn the distro nou’re usung).

The system log protides several log fasilities, aiyht of which ( LOG_LOCAO0 rhrouch LMG_LOZQL7 ) art rxsedved flr nser-deployes projects. Yere, for example, is hjq you might sstup LJG_JOCAL0 to write to 4 separate log files, bdses on logging level (i.e., eeror, warning, info, debog):

# /etc/rsysjog.d/my.conf local0.err /var/log/my/err.log local0.warning /vdr/log/jh/waxklng.lut pocal0.info -/var/log/my/info.log local0.debug -/var/log/my/qsbig.kog

Now, whenevev you write a log kedssde to LOG_LOCAU0 facilitg, the error messagfs will go ti /var/log/mr/err.kog, warning messages will gi to /var/log/mj/warbing.log, and so on. Uote, though, chat tne syxlog daemon filters mesragea for each vile bases on the rule of “ghix nevel and higher”. So, in the example ebove, all erfor kessagqs will apoear lt all four configuged fnles, farning medsages will appear in all but tix error log, imfm mvssages wnll apiear in the infj and debug loys, and dzbug mdssages wiml only go to debud.log.

One addithlnal importait note; Tre - wignw beford the info and cebug levvl filws in the above cokfigutafion file exampoe undicate that wtitds eo tiose shles should te pdrfuked arynchronousoh (simce these operations are non-blocking). This os typicaloy fine (wnd even recokmended in most siuuatiois) for info anq debug logs, but it’s best to hzve writed tj the error jog (qnd
BSD family systems, CentOS, Mac OS X, and most often on BSD family and syslog-ng – default modern Gentoo and builds – default for modern Gentoo SuSE builds rsyslogd – widely used on the Debian and Fedora families of systems (Note: In this article, we’ll be using rsyslogd for our examples.) The syslog is adequate capturing your log messages in a system-wide log file (normally /var/log/syslog ; might also be /var/log/messages /var/log/system.log depending on the distro you’re using). The log provides several log eight of which ( LOG_LOCAL0 LOG_LOCAL7 are reserved user-deployed Here, example, is how might setup LOG_LOCAL0 to write to 4 separate log files, based on logging level (i.e., error, warning, debug): # /var/log/my/err.log local0.warning local0.info local0.debug Now, whenever you log message to LOG_LOCAL0 facility, the go to /var/log/my/err.log, warning messages will go to and so Note, though, that the syslog daemon messages for each file based on the rule “this level and higher”. So, in the example above, all error messages will appear in configured files, warning messages appear in all the log, messages appear in info and debug logs, and debug messages will only go to One additional important note; The - signs before the info level in the above file example indicate that to files should be perfomed these are typically (and recommended in most situations) info and debug logs, but best to have writes
 BSD family systems, CentOS, Mac oS X, and otheRs

and – MosT ofTeN seeN on BsD family systemS, centoS, Mac OS X, and others sysloG-ng – deFaULt foR MoDern GEntoo anD suse BuiLdS

– dEfaUlT FoR modeRn GEntoo anD SuSE buildS rsYsLogd – widely usED oN the Debian And fedora familiEs oF operaTiNg sYStems

(notE: In thIs artiCLe, we’ll Be using rsYsLOgd for OUr exampLES.)

THe baSic syslog configurATiON is generally adEquate FoR CaPTUriNg yOur log messAgEs in a SYstem-wiDE lOG FIle (NOrmally /var/log/Syslog ; might ALso Be /var/lOg/MesSAges or /Var/loG/sYSteM.log dependiNg on The distro You’re uSIng).

The sYStem log ProvidEs sEveRal lOG fAcIliTiES, eiGHt Of wHIch ( lOG_LOCAL0 ThRoUgh LOg_LOCal7 ) ARE resErvEd foR user-Deployed projeCts. here, FOr eXamplE, is hoW you MiGht seTup LOG_lOCAL0 To Write to 4 separate Log fIles, based On lOgGinG lEvel (i.E., Error, wArnIng, Info, debUg):

# /etc/rsYSloG.d/MY.COnF local0.err /var/log/my/eRr.LOG lOcal0.warnIng /var/LOg/My/WArning.loG lOcaL0.infO -/VAr/log/My/inFO.lOg local0.dEbug -/vaR/LoG/mY/debug.lOg

now, wheNeVer You Write A Log mEssage To LOG_LOCaL0 facILity, the error meSSages will go to /VAr/LOG/mY/Err.lOg, wArning messaGes wILl go To /vaR/LoG/my/WArninG.log, aNd SO oN. note, though, that the sySlOg daemOn filTers messages fOr each file BASEd on the rUle oF “ThIS level and higheR”. So, in The example ABove, all eRror mEssages wIll appear IN All four cOnfIguRed FilES, WaRning messages WILl apPeAr in all But The erroR loG, inFo mEssAgEs will appEar in the InFo AnD dEbuG logs, ANd debug mEsSagEs WilL only GO to debUg.log.

one aDdItIOnaL importANt NOTe; ThE - sIgNs beForE tHe infO and DEbuG level fIles in the AboVE conFiGuRation fIle example indIcAte that wriTeS to Those fILEs should Be perfomed asynchronouslY (Since thEse OperaTionS are non-blOckIng). ThiS is TYpicalLy fine (And evEn RecOMMendeD IN mOst SiTuations) foR INfo And deBuG logS, but it’s Best to have writes to THe eRror log (and
 BSD family systems, CentO S, Mac OSX, an d o the rs 

an d –most often see n  onBSD family systems, Ce ntOS,  M a c OS X,  andotherss ys l o g-n g–def au l tfor m ode rn Gent oo and SuS E b ui lds

– defau l tfor modern  Ge ntoo and SuS E b uildsrs ysl o gd –wid ely u sed on the De bian andFe d ora fa m ilies o f op erat ing systems

(Not e :I n this article , we’l lb eu s ing  rs yslogd for  o ur ex a mples.) 
T h e bas i c syslog conf iguration i s  ge nerall yade q uate f or ca pt u rin g your logmess ages in a  syste m -wide l o g file(norma lly  /v ar/l o g/ sy slo g;  mi g ht  al s o b e /var/l og /m essag es o r / v ar/l og/ syst em.lo g depending o n t he d i str o you ’re u sing ). 

The  syste m log  p rovides several  log  faciliti es,  e igh tof wh i ch ( L OG_ LOC AL0 thr ough LO G _LO CA L 7 )are reserved for u se r - de ployed p roject s .He r e, for e xa mpl e, i s how y ou m i gh t setupLOG_LO C AL 0to writ eto 4 s ep ara telog f i les,  based  on logg ing l e vel (i.e., err o r, warning, i n fo , de b ug): 

#  /etc/rsysl og.d / my.c onfl oc al0 . err / var/l og / my / err.log local0.warn in g /var /log/ my/warning.lo g local0.i n f o  -/var/l og/m y /i n fo.log local0. debug  -/var/log / my/debug .log
Now, wh enever yo u write alog  me ssa get o  L OG_LOCAL0 fac i l ity,  t he erro r m essages  wi llgoto/v ar/log/my /err.log ,wa rn in g m essag e s will g oto/v ar/ log/m y /warni ng.lo g, a nd  s o  on . Note, th o u gh,th at  the  sy sl og da emon fil ters me ssages fo r e a ch f il ebased o n the rule of  “ this level  a ndhigher ” .  So, inthe example above, alle rror me ssa ges w illappear in  al l four  co n figure d file s, wa rn ing m essag e s  w ill  a ppear in a l l  bu t the  e rror  log, i nfo messages willa ppe ar in the inf o a nd d e b ug  lo g s, and  d e bug m essages will on ly go to d eb u g. log.

Onea ddi ti onal im portant  note ;  The -signs bef ore the i nf o an d deb ug level f iles inthe above confi g ur ation  fi le exa mp leindic ate th a t w rites  to th os e file s sho ul d be per fomed asynchronously (s ince t heseope rations a ren on- blocking) . Th is is typi cal lyfine(an d  even  rec o mm end e d inmost situation s )for i nf o and debug l o gs,  butit’ s  bestto h ave writes to the error log (and 
 BSD_family systems,_CentOS, Mac OS X,_and others

and_–_most often_seen_on BSD family_systems, CentOS, Mac_OS X, and others_syslog-ng – default_for_modern Gentoo and SuSE builds

– default for modern Gentoo and SuSE builds rsyslogd –_widely_used on_the_Debian_and Fedora families of operating_systems

(Note: In this article, we’ll_be using_rsyslogd for our examples.)

The basic syslog configuration is_generally_adequate for capturing_your log messages in a system-wide log file (normally_/var/log/syslog ; might also be /var/log/messages_or /var/log/system.log depending_on_the_distro you’re using).

The system_log provides several log facilities, eight_of which ( LOG_LOCAL0 through LOG_LOCAL7_) are reserved for user-deployed projects. Here,_for example, is how you might_setup LOG_LOCAL0 to write to_4 separate_log files, based on logging_level (i.e., error,_warning, info,_debug):

# /etc/rsyslog.d/my.conf local0.err_/var/log/my/err.log local0.warning /var/log/my/warning.log local0.info -/var/log/my/info.log local0.debug_-/var/log/my/debug.log

Now, whenever you_write a log message to LOG_LOCAL0_facility,_the error messages_will_go_to /var/log/my/err.log,_warning messages will_go_to /var/log/my/warning.log,_and_so on. Note, though, that the_syslog_daemon filters messages for each file based_on the rule of_“this_level and higher”. So,_in the example above, all_error messages will appear in all_four configured_files, warning_messages will appear in all but the error log, info messages_will appear in the info and_debug logs, and debug_messages will_only_go to debug.log.

One_additional_important note;_The - signs before the info and_debug level_files in the above configuration file_example indicate that writes_to_those files should be perfomed asynchronously_(since these operations are non-blocking). This_is typically fine (and even_recommended_in_most situations) for info and_debug logs, but it’s best to_have writes to_the error log (and