Logging with the Linux syslog facility

Logging should be done whenever possible with the syslog facility. This allows remote logging, efficient and easy filtering and automatic processing. New applications / scripts which are intended to run as daemons should be written with syslog in the first place. Exisiting applications should be redirected to syslog using e.g. initlog.

syslog facilities

A "facility" in syslog is a class of messages. It must be kept distinct from the syslog levels (LOG_EMERG, LOG_ERR, LOG_DEBUG etc...). Facilities represent distinct streams and as such can be redirected separtely to different destinations, in particular to distinct files. Syslog on Linux supports various facilities, all of which are listed in the table below. In LHCb we have a convention which facility is used for which (class of) daemon process. In principle only the local0 to local7 facilities are supposed to used for user applications. However many of the traditional ones are completely obsolete nowadays can thus be reused. The table also lists the (class of) daemon processes to use and to which file they will be redirected.

Facility Process class File
LOG_NEWS all network devices (switches) /var/log/network
LOG_UUCP all storage devices and processes /var/log/storage
LOG_LOCAL0 reserved  
LOG_LOCAL1 DIM dns /var/log/dnsd
LOG_LOCAL2 SPECS server /var/log/specs
LOG_LOCAL3 CCSERV /var/log/ccserv
LOG_LOCAL4 dhcpd /var/log/dhcpd
LOG_LOCAL5 other processes (e.g. Muon HV DIM server) /var/log/
LOG_LOCAL6 reserved  
LOG_LOCAL7 used for bootlogs on Linux  

Facilities not listed here should not be used, as the messages will be mixed up with (important) system processe

syslog & logrotate configuration

If the application is not syslog aware the rpms should make sure that initlog starts them with the correct facility. Applications should not configure syslog or logrotate. On diskless nodes. all messages will be forwarded to the corresponding controls-pc. On the controls PC syslog will be configured by Quattor accordingly. Each file created by syslog must be treated by logrotate.

Some important log messages of control PCs could be forwarded also to a central logserver (to be created).

syslog and Windows

Peter has pointed out several interesting possibilties for logging Windows. This is currently not implemented. The Windows daemons should be mapped to the same facilities as their Linux counterparts.
Eventlog to Syslog Service for Windows : https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys
Syslog filtering : http://www.netadmintools.com/art127.html

Edit | Attach | Watch | Print version | History: r3 < r2 < r1 | Backlinks | Raw View | WYSIWYG | More topic actions
Topic revision: r3 - 2008-03-11 - LoicBrarda
    • Cern Search Icon Cern Search
    • TWiki Search Icon TWiki Search
    • Google Search Icon Google Search

    LHCb All webs login

This site is powered by the TWiki collaboration platform Powered by PerlCopyright & 2008-2021 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
or Ideas, requests, problems regarding TWiki? use Discourse or Send feedback