Syslog - Revision history

Jimbo: Reverted edits by 205.207.27.229 (Talk) to last revision by Jimbo

2011-08-01T22:27:00Z

Reverted edits by 205.207.27.229 (Talk) to last revision by Jimbo

205.207.27.229: /* Testing */

2011-05-09T02:06:05Z

Testing

Jimbo at 11:49, 3 January 2009

2009-01-03T11:49:38Z

DrModiford: Changed article name

2008-06-06T10:58:23Z

Changed article name

DrModiford: Added Syslog-NG guide link

2008-06-06T10:57:14Z

Added Syslog-NG guide link

DrModiford: Moved Network to sub section

2008-02-04T14:26:09Z

Moved Network to sub section

DrModiford: Split operations into seperate sub headings

2008-02-04T14:25:55Z

Split operations into seperate sub headings

DrModiford: Added Network mode

2008-02-04T14:24:34Z

Added Network mode

DrModiford: Table finally working!

2008-02-04T14:04:43Z

Table finally working!

DrModiford: Dang tricky tables!

2008-02-04T14:02:59Z

Dang tricky tables!

@@ Line 71: / Line 71: @@
 Certain hardware devices that can raise Syslog events (including Cisco equipment) often use a numerical variation of the above levels, however it is recommended that these are not used in the FreeBSD Syslog configuration.
-EfB1HZ  <a href="http://yygrnfgtixah.com/">yygrnfgtixah</a>
+== Testing ==
 == See also ==

@@ Line 71: / Line 71: @@
 Certain hardware devices that can raise Syslog events (including Cisco equipment) often use a numerical variation of the above levels, however it is recommended that these are not used in the FreeBSD Syslog configuration.
-== Testing ==
+EfB1HZ  <a href="http://yygrnfgtixah.com/">yygrnfgtixah</a>
-−
-It is possible to create (or ''spoof'') an event from the console using the [[logger]] command.  This is useful when testing a Syslog configuration that is unlikely to happen at a given time, such as a 'critical' level event from a newly installed service.
-−
-The logger command takes the following form:
-−
- '''logger''' -p service.level "test message in quotes"
-−
-Where the -p signifies the use of a level (the 'p' standing for '''p'''riority), which a working example on a default FreeBSD configuration would be:
-−
- '''logger''' -p mail.warning "You have entered a warning into the mail service log"
-−
-Reading the mail service log reveals that the event has been written:
-−
- [root@syslog /]# tail /var/log/maillog
- Feb  4 10:46:10 syslog newsyslog[469]: logfile first created
- Feb  4 10:46:29 syslog sm-mta[613]: starting daemon (8.14.2): SMTP+queueing@00:30:00
- Feb  4 10:46:44 syslog sm-msp-queue[617]: starting daemon (8.14.2): queueing@00:30:00
- Feb  4 13:39:48 syslog drmodiford: '''You have entered a warning into the mail service log'''
-−
-The Syslog service can also log events to the root console, which a working example on a default FreeBSD configuration would be:
-−
- logger -p auth.notice "Message appears on the console."
-−
-The above message will be written on the root console, which would mean on a [[headless server]] such messages going unnoticed - but they are fortunately logged to the authentication service log file:
-−
- [root@syslog /]# tail /var/log/auth.log
- Feb  4 10:46:10 syslog newsyslog[469]: logfile first created
- Feb  4 10:46:14 syslog sshd[607]: Server listening on :: port 22.
- Feb  4 10:46:14 syslog sshd[607]: Server listening on 0.0.0.0 port 22.
- Feb  4 10:51:10 syslog login: login on ttyv0 as drmodiford
- Feb  4 10:51:14 syslog su: drmodiford to root on /dev/ttyv0
- Feb  4 12:14:55 syslog sshd[73815]: Accepted keyboard-interactive/pam for drmodiford from 10.0.0.6 port 4726 ssh2
- Feb  4 12:15:02 syslog su: drmodiford to root on /dev/ttyp0
- Feb  4 13:45:55 syslog drmodiford: '''Message appears on the console.'''
-−
-You may have seen such 'pop-up' messages appear when you [[su]] into [[root]] user.
 == See also ==

← Older revision		Revision as of 11:49, 3 January 2009
Line 112:		Line 112:

	See also a guide to [[Syslog-NG Installation\|installing Syslog-NG]].		See also a guide to [[Syslog-NG Installation\|installing Syslog-NG]].
		+
		+	[[Category: System Commands]]

← Older revision		Revision as of 10:58, 6 June 2008
Line 111:		Line 111:
	== See also ==		== See also ==

−	See also a guide to [[Syslog-NG Installation ~~Guide~~\|installing Syslog-NG]].	+	See also a guide to [[Syslog-NG Installation\|installing Syslog-NG]].

← Older revision		Revision as of 10:57, 6 June 2008
Line 111:		Line 111:
	== See also ==		== See also ==

−	See also:	+	See also a guide to [[Syslog-NG Installation Guide\|installing Syslog-NG]].

@@ Line 15: / Line 15: @@
 The 'or higher' used above is a feature of Syslog where a specified level is the lowest level of detrail required and anything higher will also be logged.  The levels are noted below.  As an example noting 'informative' from the mail service will log all events since it is the lowest level, however noting 'notice' from the authentication service will not log 'informative' events below it.
-== Network operation ==
+=== Network operation ===
 By default the Syslog service listens to the local host only.  This is useful for monitoring in-host services but is limited to each server writing logs locally and for the network administrator to login to each server to view them.  This is where a central Syslog server is useful.  Such a server should have a large local disk to store a larger volume of logs.

@@ Line 5: / Line 5: @@
 The default configuration notes events from the security, authentication, ftp, mail and other key service depending on the 'level' of importance.  These levels range between simply informative messages to critical ones, with varying degrees of importance in-between.  These levels are noted below.
-== Local operation ==
+== Operation ==
 The Syslog uses a configuration file to act as a rule set by which it determines the service and level of events to log and where to log them to.  A default installation from FreeBSD will log anything informative (or higher) from the mail service to a log file stored in /var/log/maillog, and log any notices (or higher) from the authentication service to the primary console window.

@@ Line 52: / Line 52: @@
 | Debugging
 | Generally not used except for capturing everything for fault-finding.
-|-}
+|-
 There are numerical equivalents of these levels that are used by certain hardware devices that can raise Syslog events, however it is recommended that these are not used in the FreeBSD Syslog configuration.