Logging with the Linux syslog facility

Logging should be done whenever possible with the syslog facility. This allows remote logging, efficient and easy filtering and automatic processing. New applications / scripts which are intended to run as daemons should be written with syslog in the first place. Exisiting applications should be redirected to syslog using e.g. initlog.

syslog facilities

A "facility" in syslog is a class of messages. It must be kept distinct from the syslog levels (LOG_EMERG, LOG_ERR, LOG_DEBUG etc...). Facilities represent distinct streams and as such can be redirected separtely to different destinations, in particular to distinct files. Syslog on Linux supports various facilities, all of which are listed in the table below. In LHCb we have a convention which facility is used for which (class of) daemon process. In principle only the local0 to local7 facilities are supposed to used for user applications. However many of the traditional ones are completely obsolete nowadays can thus be reused. The table also lists the (class of) daemon processes to use and to which file they will be redirected.

Facilities not listed here should not be used, as the messages will be mixed up with (important) system processe

syslog & logrotate configuration

If the application is not syslog aware the rpms should make sure that initlog starts them with the correct facility. Applications should not configure syslog or logrotate. On diskless nodes. all messages will be forwarded to the corresponding controls-pc. On the controls PC syslog will be configured by Quattor accordingly. Each file created by syslog must be treated by logrotate.

Some important log messages of control PCs could be forwarded also to a central logserver (to be created).

syslog and Windows

Peter has pointed out several interesting possibilties for logging Windows. This is currently not implemented. The Windows daemons should be mapped to the same facilities as their Linux counterparts.
Eventlog to Syslog Service for Windows : https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys
Syslog filtering : http://www.netadmintools.com/art127.html