UNIX SYSLOG Manual Configuration

This document contains instructions on how to manually configure the /etc/syslog.conf file in order to meet the BellSouth standard requirements for UNIX platform services. The /etc/syslog.conf file contains information used by the system log daemon, syslogd, to forward a system message to appropriate log files and/or users. A configuration entry is composed of two tab-separated fields: selector action

The selector and action fields must be separated by one or more tabs; spaces dont work and become invisible errors that can be hard to track. Cutting and pasting with your Windows system is one way to introduce such errors. You can view the hidden characters by using the command cat vet /etc/syslog.conf . The selector field is a semicolon-separated list of priority specifications in the following format: facility.level;facility.level Recognized values for facility include: user Messages generated by user processes. This is the default priority for messages from programs or facilities not listed in this file. Messages generated by the kernel. The mail system. System daemons, such as in.ftpd. The authorization system: login, su, getty, among others. The line printer spooling system: lpr, lpc,among others. Reserved for the USENET network news system. Reserved for the UUCP system; it does not currently use the syslog mechanism. The cron/at facility; crontab, at, cron, among others. An asterisk indicates all facilities except for the mark facility.
Page 1 of 6 Version 7

kern mail daemon auth lpr news uucp cron *

IJSN0000

PRIVATE/PROPRIETARY/SECURE Contains Private and/or Proprietary Information. May Not Be Used Or Disclosed Outside The BellSouth Companies Except Pursuant To A Written Agreement. Must Be Securely Stored When Not In Use.

UNIX SYSLOG Manual Configuration

Recognized level values are shown below in order of severity from highest to lowest. Levels indicate the minimum importance that a message must have in order to be logged; a level of lower severity will include each level of a higher severity. For example, mail.crit will also include mail.alert and mail.emerg emerg alert crit err warning notice For panic conditions that would normally be broadcast to all users. For conditions that should be corrected immediately, such as a corrupted system database. For warnings about critical conditions, such as hard device errors. For other errors. For warning messages. For conditions that are not error conditions, but may require special handling. A configuration entry with a level value of notice must appear on a separate line. Informational messages. For messages that are normally used only when debugging a program. Do not send messages from the indicated facility to the selected file.

info debug none

The action field defines where to forward the message.

IJSN0000

Page 2 of 6

Version 7

PRIVATE/PROPRIETARY/SECURE Contains Private and/or Proprietary Information. May Not Be Used Or Disclosed Outside The BellSouth Companies Except Pursuant To A Written Agreement. Must Be Securely Stored When Not In Use.

UNIX SYSLOG Manual Configuration

AIX Configuration On the AIX platform, the syslogd daemon has been configured to write the syslog messages to /var/adm/messages. If you are unable to load the platform DDS package, you can perform the steps in order to create a properly formatted /etc/syslog.conf file:
Se q Action Details

1 2

Edit /etc/syslog.conf Add the following lines:

# vi /etc/syslog.conf

3 4

NOTE: Save and close your file Re-initialize syslogd

mail.info /var/adm/syslog/mail.log *.info;mail.none /var/adm/messages *.warning;mail.none /dev/console *.alert;mail.none /dev/sysmsg *.emerg * These fields should be tab-delimited. Do not use cut and paste.

# refresh -s syslogd

Sample file:
mail.info /var/adm/syslog/mail.log *.info;mail.none /var/adm/messages *.warning;mail.none /dev/console *.alert;mail.none /dev/sysmsg *.emerg * *.info /bto/sys/tng/em/opr/config/bos76886/pipe/oprpipe0023

IJSN0000

Page 3 of 6

Version 7

PRIVATE/PROPRIETARY/SECURE Contains Private and/or Proprietary Information. May Not Be Used Or Disclosed Outside The BellSouth Companies Except Pursuant To A Written Agreement. Must Be Securely Stored When Not In Use.

UNIX SYSLOG Manual Configuration

HP/UX Configuration On the HP/UX platform, the syslogd daemon has been configured to write the syslog messages to /var/adm/syslog/syslog.log. If you are unable to load the platform DDS package, you can perform the steps in order to create a properly formatted /etc/syslog.conf file:
Seq
1 2

Action
edit /etc/syslog.conf Add the following lines: # vi /etc/syslog.conf

Details
mail.info /var/adm/syslog/mail.log *.info;mail.none /var/adm/syslog/syslog.log *.warning /dev/console mail.debug /var/adm/syslog/mail.log *.alert /dev/console *.emerg * THESE FIELDS SHOULD BE TAB-DELIMITED # kill -HUP `cat /var/run/syslog.pid`

4 5

NOTE: Save and Close your file Re-initialize syslogd

Sample file:
# /etc/syslog.conf # # Modification history: # created: dff 5/3/91 # modified: dff 02.06.92 - redirected mail msgs to traditional place # modified: dff 09.08.92 - replaced self w/GA in forwarded warnings # tm 941202 second "*.warning /usr/adm/syslog" changed to /dev/console # tm 950821 10.x updates # wds 000927 changed mail.info to /var/adm/syslog/mail.log # wds 010307 Removed extraneous lines per CAR Case # 976387 ################################################################ ############# mail.info /var/adm/syslog/mail.log *.info;mail.none /var/adm/syslog/syslog.log *.warning # @(#)B.11.11_LR /dev/console

IJSN0000

Page 4 of 6

Version 7

PRIVATE/PROPRIETARY/SECURE Contains Private and/or Proprietary Information. May Not Be Used Or Disclosed Outside The BellSouth Companies Except Pursuant To A Written Agreement. Must Be Securely Stored When Not In Use.

UNIX SYSLOG Manual Configuration

# syslogd configuration file. # # See syslogd(1M) for information about the format of this file. # mail.debug /var/adm/syslog/mail.log *.alert /dev/console *.alert root *.emerg *

Solaris Configuration On the SUN platforms, the syslogd daemon has been configured to write the syslog messages to /var/adm/messages. If you are unable to load the platform DDS package, you can perform the steps in order to create a properly formatted /etc/syslog.conf file:
Seq
1 2

Action
edit /etc/syslog.conf Add the following lines: # vi /etc/syslog.conf

Details
mail.info /var/adm/syslog/mail.log *.info;mail.none /var/adm/messages *.alert;mail.none /dev/console *.err;kern.notice;auth.notice /dev/sysmsg *.err;kern.debug;daemon.notice;mail.crit /var/adm/messages THESE FIELDS SHOULD BE TAB-DELIMITED # kill -HUP `cat /var/run/syslog.pid`

4 5

NOTE: Save and Close your file Re-initialize syslogd

Sample file:
# /etc/syslog.conf # # created: jeh # modified: # whk # wds # wds # wds #

03.01.94 07/15/97 07/07/00 - changed handling of mail messages 09/27/00 - changed handling of mail messages 05/08/02 - changed /dev/console to /dev/sysmsg

IJSN0000

Page 5 of 6

Version 7

PRIVATE/PROPRIETARY/SECURE Contains Private and/or Proprietary Information. May Not Be Used Or Disclosed Outside The BellSouth Companies Except Pursuant To A Written Agreement. Must Be Securely Stored When Not In Use.

UNIX SYSLOG Manual Configuration

################################################################## ########### mail.info /var/adm/syslog/mail.log *.info;mail.none /var/adm/messages *.alert;mail.none /dev/sysmsg #ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */ # Copyright (c) 1991-1998 by Sun Microsystems, Inc. # All rights reserved. # syslog configuration file. *.err;kern.notice;auth.notice /dev/sysmsg *.err;kern.debug;daemon.notice;mail.crit /var/adm/messages *.alert;kern.err;daemon.err operator *.alert root *.emerg * mail. *.info /bto/sys/tng/em/opr/config/bos62484/pipe/oprpipe0042

AMENDMENT HISTORY Version 7 6 5 4 3 2 1 Date 01/22/2008 06/07/2007 06/05/2007 04/05/2007 03/30/2007 01/17/2007 03/01/2005 Revision Description Update ownership Changed doc reviewer Changed AIX example entries for /etc/syslog.conf Added notes that selector and action fields should be tab-delimited, not spaced Change owner to Russ O'Neal Remove duplicate line per case 6433122 Initial Issuance

IJSN0000

Page 6 of 6

Version 7

PRIVATE/PROPRIETARY/SECURE Contains Private and/or Proprietary Information. May Not Be Used Or Disclosed Outside The BellSouth Companies Except Pursuant To A Written Agreement. Must Be Securely Stored When Not In Use.