Syslogd
Tracking system events
Log servers
• Applications are constantly encountering
events which should be recorded
–
–
–
–
users attempt to login with bad passwords
servers can’t properly start
disk runs out of space
and others
• Many system servers are written to post
messages to a log server for later analysis
Issues of managing a log server
•
•
•
•
•
What messages are stored
How long to store them
Where should they be stored for access
How are the logs backed up / recycled
Should the server function for a network or
a machine
Syslog
• Primarily handles system messages
• Classifies messages according
– to the source
– to the severity
• Stores in files according to a configuration file
• Usually stores in /var/log
• Can redirect messages to
– another machine
– a device like a console
Source subsystems
•
•
•
•
•
•
•
•
auth authpriv,
cron,
daemon,
kern,
lpr,
mail,
mark,
news,
• security (same as
auth),
• syslog,
• user,
• uucp and
• local0 through
local7.
Message priorities
•
•
•
•
•
•
•
•
•
panic (same as emerg),
emerg,
alert,
crit,
err, error (same as err),
warning, warn (same as warning),
notice,
info,
debug
higher
lower
Example scenario
User enters
bad password
syslog.conf
Authentication
server
auth.notice
syslogd
/var/log/messages
# from /etc/syslog.conf
...
auth.info
/var/log/messages
syslog.conf
auth.notice
mail.warn
syslogd
/var/log/mail.warn
/var/log/messages
network
Other scenarios
remote server
syslog.conf format
format
facility.priority
destination
logs this level and higher priority
format
facility.=priority
destination
logs ONLY this level
format
facility.!priority
destination
logs NOT this level and higher priority (but all below)
format
facility.!=priority
destination
logs NOT this level but ALL OTHER LEVELS
syslog.conf example
# Kernel messages are first, stored in the kernel
# file, critical messages and higher ones also go
# to another host and to the console
#
kern.*
/var/adm/kernel
kern.crit
@finlandia
kern.crit
/dev/console
kern.info;kern.!err /var/adm/kernel-info
(info thru warning)
EXAMPLE LOG FILE info -> auth.log
Feb 10 17:24:58 testserver sshd[5616]: Could not reverse map address 192.168.2.2.
Feb 10 17:24:59 testserver sshd[5616]: Accepted password for dgame from 192.168.2.2 port 1186 ssh2
Feb 10 17:25:00 testserver sshd(pam_unix)[5618]: session opened for user dgame by (uid=501)
Feb 10 17:25:05 testserver su(pam_unix)[5655]: session opened for user root by dgame(uid=501)