Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-) Softpanorama Search

Syslog Configuration Debugging

syslog has a debugging mechanism that allows the UNIX administrator to trace the emergence and flow of syslog messages.

Syslog is debugged in two parts:

• On startup, syslog displays a two-dimensional matrix illustrating its configuration as defined in the configuration file /etc/syslog.conf.

• In real time, syslog displays inbound syslog messages and specifies how the messages are processed.

Follow this procedure to turn on syslog debugging.

1. Kill syslogd process with a kill -15 pid command.
    
2. Restart syslogd with the command /usr/sbin/syslogd -d. This will start syslogd in debug mode. syslogd will first read its configuration file and write output similar to the following:

   # /usr/sbin/syslogd -d
   getnets() found 1 addresses, they are: 0.0.0.0.2.2
   amiloghost() testing 127.0.0.1.2.2
   I am loghost
   amiloghost() testing 127.0.0.1.2.2
   nlogs 6

   The next section is syslogd reading from syslog.conf.

   cfline(*.err;kern.notice;auth.notice              /dev/console)
   cfline(*.err;kern.debug;daemon.notice;mail.crit   /var/adm/messages)
   cfline(*.alert;kern.err;daemon.err                operator)
   cfline(*.alert                                    root)
   cfline(*.emerg                                    *)
   cfline(mail.debug                                 /var/log/syslog)

   Here, syslogd prints version information.

   syslogd: version 1.59
   Started: Fri May 15 21:07:26 1998
   Input message count: system 0, network 0

   This section is a matrix of inputs and outputs. The value in each position represents the minimum severity level (7 = debug, 6 = info, 5 = notice, 4 = warning, 3 = err, 2 = crit, 1 = alert, 0 = emerg, x = nothing). Each column is a different service (left to right: kern, user, mail, daemon, auth, lpr, news, uucp, cron, local0-local7, mark). Each row represents a different output (a file or user).

   # Outputs: 6
   5 3 3 3 5 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 X CONSOLE: /dev/console
   7 3 2 5 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 X FILE: /var/adm/messages
   3 1 1 3 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 X USERS: operator
   1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 X USERS: root
   0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 X WALL:
   X X 7 X X X X X X X X X X X X X X X X X X X X X X FILE: /var/log/syslog
   Per File Statistics
   File                Tot    Dups    Nofwd   Errs
   ----                ---    ----    -----   ----
   /dev/console         0       0       0       0
   /var/adm/messages    0       0       0       0
   operator             0       0       0       0
   root                 0       0       0       0
   WALL                 0       0       0       0
   /var/log/syslog      0       0       0       0
   syslogd: restarted
   off & running....
   Logging to FILE /var/adm/messages
   Logging to FILE /var/adm/messages

3. Wait for or cause events that will log to syslog.
   
   Example 1: The following command is run

   logger -p auth.notice "This is a test."

   and then syslogd in debug mode will display
   
   Logging to CONSOLE /dev/console

   and the following text will appear on the console window.

   May 15 16:21:31 alpha pete: This is a test.
   

   Example 2: the following command is run

   logger -p mail.crit "This is the next test."
   

   and then syslogd in debug mode will display

   Logging to FILE /var/adm/messages

   and the following entry will be written to /var/adm/messages.

   May 15 16:21:49 alpha pete: This is the next test.
   

4. To stop testing syslog, press ^C in the window where syslogd is running in debug mode. syslog will display the following message:

   ^Csyslogd: going down on signal 2
   syslogd: going down on signal 2
   #

5. Restart syslogd in normal mode via startup scripts.
    

Note: syslogd should be run in debug mode only interactively. The system will hang if syslogd is run in debug mode in the system startup scripts (usually /etc/rc2.d/ S74syslog ).