{"id":18649,"date":"2026-05-12T11:18:48","date_gmt":"2026-05-12T10:18:48","guid":{"rendered":"https:\/\/roglacup.com\/klaus62\/?p=18649"},"modified":"2026-05-12T11:50:52","modified_gmt":"2026-05-12T10:50:52","slug":"syslog","status":"publish","type":"post","link":"https:\/\/roglacup.com\/klaus62\/2026\/05\/12\/syslog\/","title":{"rendered":"SYSLOG.CONF"},"content":{"rendered":"\n

The \/etc\/syslog.conf file<\/h1>\n\n\n\n

The \/etc\/syslog.conf file configures the level of information that the storage system records. It specifies the subsystem from which the message originated, the severity of the message, and where the message is sent.<\/p>\n\n\n\n

The \/etc\/syslog.conf file consists of lines with two tab-separated (not space-separated) fields of the following form: facility<\/var>.level<\/var> action<\/var><\/p>\n\n\n\n

The facility parameter specifies the subsystem from which the message originated. The following table describes the facility parameter keywords.<\/p>\n\n\n\n

Keyword<\/th>Description<\/th><\/tr><\/thead>
auth<\/td>Messages from the authentication system, such as login<\/td><\/tr>
cron<\/td>Messages from the internal cron facility<\/td><\/tr>
daemon<\/td>Messages from storage system daemons, such as rshd<\/td><\/tr>
kern<\/td>Messages from the storage system kernel<\/td><\/tr>
*<\/td>Messages from all facilities<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The level parameter describes the severity of the message. The following table describes the level parameter keywords arranged in order from most to least severe.<\/p>\n\n\n\n

Level<\/th>Description<\/th><\/tr><\/thead>
emerg<\/td>Panic condition that causes a disruption of normal service<\/td><\/tr>
alert<\/td>Condition that you should correct immediately, such as a failed disk<\/td><\/tr>
crit<\/td>Critical conditions, such as disk errors<\/td><\/tr>
err<\/td>Errors, such as those caused by a bad configuration file<\/td><\/tr>
warning<\/td>Conditions that might become errors if not corrected<\/td><\/tr>
notice<\/td>Conditions that are not errors, but might require special handling<\/td><\/tr>
info<\/td>Information, such as the hourly uptime message<\/td><\/tr>
debug<\/td>Used for diagnostic purposes<\/td><\/tr>
*<\/td>All levels of errors<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The action parameter specifies where to send messages. Messages for the specified level or higher are sent to the message destination. The following table describes the possible actions and gives examples of each action.<\/p>\n\n\n\n

Action<\/th>Example<\/th><\/tr><\/thead>
Send messages to a file specified by a path.<\/td>\/etc\/messages<\/td><\/tr>
Send messages to a host name preceded by an @ sign.<\/td>@adminhost<\/td><\/tr>
Send messages to the console.<\/td>\/dev\/console or *<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Posted from: https:\/\/documents.uow.edu.au\/~blane\/netapp\/ontap\/sysadmin\/monitoring\/concept\/c_oc_mntr_message-logging-syslog-file.html<\/a><\/p>\n\n\n\n

Syslog stands for System Logging Protocol <\/strong>and is a standard protocol used to send system log or event messages to a specific server<\/strong>, called a syslog server. It is primarily used to collect various device logs from several different machines in a central location for monitoring and review.<\/p>\n\n\n\n

The protocol is enabled on most network equipment such as routers, switches, firewalls, and even some printers and scanners. In addition, syslog is available on Unix and Linux based systems and many web servers including Apache. Syslog is not installed by default on Windows systems, which use their own Windows Event Log. These events can be forwarded via third-party utilities or other configurations using the syslog protocol.<\/p>\n\n\n\n

Syslog is defined in RFC 5424<\/a>, The Syslog Protocol, which obsoleted the previous RFC 3164.<\/p>\n\n\n\n

Syslog components<\/h3>\n\n\n\n

On any given device various events are generated by the system in response to changing conditions. These events are typically logged locally where they can be reviewed and analyzed by an administrator. However, monitoring numerous logs over an equally numerous number of routers, switches, and systems would be time consuming and impractical. Syslog helps solve this issue by forwarding those events to a centralized server.<\/p>\n\n\n\n

Syslog transmission<\/h3>\n\n\n\n

Traditionally, Syslog uses the UDP protocol on port 514 but can be configured to use any port. In addition, some devices will use TCP 1468 to send syslog data to get confirmed message delivery.<\/p>\n\n\n\n

Syslog packet transmission is asynchronous. What causes a syslog message to be generated is configured within the router, switch, or server itself. Unlike other monitoring protocols, such as SNMP, there is no mechanism to poll the syslog data. In some implementations, SNMP may be used to set or modify syslog parameters remotely.<\/p>\n\n\n\n

Posted from: https:\/\/www.paessler.com\/it-explained\/syslog<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

The \/etc\/syslog.conf file The \/etc\/syslog.conf file configures the level of information that the storage system records. It specifies the subsystem from which the message originated, the severity of the message, and where the message is sent. The \/etc\/syslog.conf file consists of lines with two tab-separated (not space-separated) fields of the following form: facility.level action The facility parameter specifies the… Read More »SYSLOG.CONF<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":18660,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"[\"content\",\"tags\",\"comments\"]","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[17,16],"tags":[],"class_list":["post-18649","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","category-virtualization"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/roglacup.com\/klaus62\/wp-json\/wp\/v2\/posts\/18649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/roglacup.com\/klaus62\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/roglacup.com\/klaus62\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/roglacup.com\/klaus62\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/roglacup.com\/klaus62\/wp-json\/wp\/v2\/comments?post=18649"}],"version-history":[{"count":3,"href":"https:\/\/roglacup.com\/klaus62\/wp-json\/wp\/v2\/posts\/18649\/revisions"}],"predecessor-version":[{"id":18662,"href":"https:\/\/roglacup.com\/klaus62\/wp-json\/wp\/v2\/posts\/18649\/revisions\/18662"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/roglacup.com\/klaus62\/wp-json\/wp\/v2\/media\/18660"}],"wp:attachment":[{"href":"https:\/\/roglacup.com\/klaus62\/wp-json\/wp\/v2\/media?parent=18649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/roglacup.com\/klaus62\/wp-json\/wp\/v2\/categories?post=18649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/roglacup.com\/klaus62\/wp-json\/wp\/v2\/tags?post=18649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}