Syslog Configuration Debugging

syslog has a debugging mechanism that allows the UNIX administrator to trace the emergence and flow of syslog messages. syslog is debugged in two parts:

On startup, syslog displays a two-dimensional matrix illustrating its configuration as defined in the configuration file /etc/syslog.conf.

In real time, syslog displays inbound syslog messages and specifies how the messages are processed.

Follow this procedure to turn on syslog debugging.

Kill syslogd process with a kill -15 pid command.

Restart syslogd with the command /usr/sbin/syslogd -d. This will start syslogd in debug mode. syslogd will first read its configuration file and write output similar to the following:

# /usr/sbin/syslogd -d
getnets() found 1 addresses, they are: 0.0.0.0.2.2
amiloghost() testing 127.0.0.1.2.2
I am loghost
amiloghost() testing 127.0.0.1.2.2
nlogs 6

The next section is syslogd reading from syslog.conf.

cfline(*.err;kern.notice;auth.notice              /dev/console)
cfline(*.err;kern.debug;daemon.notice;mail.crit   /var/adm/messages)
cfline(*.alert;kern.err;daemon.err                operator)
cfline(*.alert                                    root)
cfline(*.emerg                                    *)
cfline(mail.debug                                 /var/log/syslog)

Here, syslogd prints version information.

syslogd: version 1.59
Started: Fri May 15 21:07:26 1998
Input message count: system 0, network 0

This section is a matrix of inputs and outputs. The value in each position represents the minimum severity level (7 = debug, 6 = info, 5 = notice, 4 = warning, 3 = err, 2 = crit, 1 = alert, 0 = emerg, x = nothing). Each column is a different service (left to right: kern, user, mail, daemon, auth, lpr, news, uucp, cron, local0-local7, mark). Each row represents a different output (a file or user).

# Outputs: 6
5 3 3 3 5 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 X CONSOLE: /dev/console
7 3 2 5 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 X FILE: /var/adm/messages
3 1 1 3 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 X USERS: operator
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 X USERS: root
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 X WALL:
X X 7 X X X X X X X X X X X X X X X X X X X X X X FILE: /var/log/syslog
Per File Statistics
File                Tot    Dups    Nofwd   Errs
----                ---    ----    -----   ----
/dev/console         0       0       0       0
/var/adm/messages    0       0       0       0
operator             0       0       0       0
root                 0       0       0       0
WALL                 0       0       0       0
/var/log/syslog      0       0       0       0
syslogd: restarted
off & running....
Logging to FILE /var/adm/messages
Logging to FILE /var/adm/messages

Wait for or cause events that will log to syslog.

Example 1: The following command is run
```
logger -p auth.notice "This is a test."
```
and then syslogd in debug mode will display

Logging to CONSOLE /dev/console

and the following text will appear on the console window.
```
May 15 16:21:31 alpha pete: This is a test.
```
Example 2: the following command is run
```
logger -p mail.crit "This is the next test."
```
and then syslogd in debug mode will display
```
Logging to FILE /var/adm/messages
```
and the following entry will be written to /var/adm/messages.
```
May 15 16:21:49 alpha pete: This is the next test.
```
To stop testing syslog, press ^C in the window where syslogd is running in debug mode. syslog will display the following message:
```
^Csyslogd: going down on signal 2
syslogd: going down on signal 2
#
```
Restart syslogd in normal mode with the command /usr/sbin/syslogd.

syslogd should be run in debug mode only interactively. The system will hang if syslogd is run in debug mode in the system startup scripts (usually /etc/rc2.d/ S74syslog ).

Copyright © 1996-2008 by Dr. Nikolai Bezroukov. www.softpanorama.org was created as a service to the UN Sustainable Development Networking Programme (SDNP) in the author free time. Submit comments This document is an industrial compilation designed and created exclusively for educational use and is placed under the copyright of the Open Content License(OPL). Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

Standard disclaimer: The statements, views and opinions presented on this web page are those of the author and are not endorsed by, nor do they necessarily reflect, the opinions of the author present and former employers, SDNP or any other organization the author may be associated with. We do not warrant the correctness of the information provided or its fitness for any purpose.

Last modified: February 28, 2008