Testing System Logging System Logging Configuration

to prefix a priority level and negate its meaning; it excludes this and higher priority levels from logging, specifying logging of only lower priority levels • To protect syslogd daemon from potential network intruders, new options −r and −h are introduced; they control daemon behavior toward accepting and forwarding log messages between hosts in the network. The daemon must be started appropriately if the corresponding network related logging is supposed. Although listed logging enhancements could be disputed, under certain circumstances their implementation could be handy.

9.2.3 The logger Command

UNIX provides the logger command, which is an extremely useful command to deal with system logging. The logger command sends logging messages to the syslogd daemon, and consequently provokes system logging. This means we can check from the command line at any time the syslogd daemon and its configuration. The command itself can also be a part of a user programscript to generate necessary operational logging messages. The logger command provides a method for adding one−line entries to the system log file from the command line. One or more message arguments can be entered with options on the command line, in which case each of them is logged immediately. If an optional message is not specified, either an optional file specified with the −f option or the standard input is added to the log. The format of the command is: logger [ −i ] [ −f file ] [ −p priority ] [ −t tag ] [ message ]... Where the available options and operands are: −f filename Use the contents of file filename as the message to log. −i Log the process ID of the logger process with each line. −p priority Enter the message with the specified priority specified selector entry; the message priority can be specified numerically, or as a facility.level pair. The default priority is user.notice. −t tag Mark each line added to the log with the specified tag. message The string arguments whose contents are concatenated together in the specified order, separated by the space a quoted message presents a single string argument.

9.2.4 Testing System Logging

It is a good idea to test the system logging after it has been configured and the syslogd daemon has been recycled. The logger command allows efficient and detailed logging testing. Here is an example from the HP−UX 10.20 system; it is named black and has the following configuration: cat etcsyslog.conf This is the etcsyslog.conf file Time marks 212 We will test the mail subsystem, or, to use the system logging terminology, the mail facility. All entries in the configuration file relevant to the mail logging are printed in bold. The system is configured to enable logging of all mail log messages above the info level in the varlogmaillog file; this includes everything except debug messages. Critical−level and above mail messages are also logged in the system log file varlogsyslog besides many other system messages, and they are sent to the remote loghost, as well. Further processing and logging of the sent messages is defined by the logging configuration file etcsyslog at the remote system. Finally, all emergency panic messages are sent to all logged−in users. The user bjl has issued a sequence of the logger command from the command line with different logging options and test messages. The syslogd daemon should catch all generated messages and forward them into corresponding logging files, according to the actual logging configuration. logger −p mail.debug Testing mail.debug logger −p mail.info Testing mail.info logger −p mail.notice Testing mail.notice logger −p mail.warning Testing mail.warning logger −p mail.err Testing mail.err logger −p mail.crit Testing mail.crit logger −p mail.alert Testing mail.alert logger −p mail.emerg Testing mail.emerg Next, we check the local log files: cat varlogmaillog | grep Testing May 11 16:57:38 black bjl: Testing mail.info May 11 16:58:04 black bjl: Testing mail.notice May 11 16:58:23 black bjl: Testing mail.warning May 11 16:58:39 black bjl: Testing mail.err May 11 16:58:54 black bjl: Testing mail.crit May 11 16:59:12 black bjl: Testing mail.alert May 11 16:59:29 black bjl: Testing mail.emerg Simultaneously, the panic emerg message was sent to all logged−in users: Message from syslogdblack at Tue May 11 16:59:29 1999 ... black bjl: Testing mail.emerg As expected, all test messages have been logged in the varlogmaillog file except the debug message; the emergency message was also sent, and displayed, on the terminals of all logged−in users. cat varlogsyslog ..... 213 May 11 16:00:19 black syslogd: restart May 11 16:03:42 black inetd[964]: Rereading configuration May 11 16:03:42 black inetd[964]: bootpsudp: Deleted service May 11 16:03:42 black inetd[964]: Configuration complete May 11 16:14:32 black − MARK −− May 11 16:34:32 black −− MARK −− May 11 16:45:21 black syslogd: restart May 11 16:54:32 black −− MARK −− May 11 16:58:54 black bjl: Testing mail.crit May 11 16:59:12 black bjl: Testing mail.alert May 11 16:59:29 black bjl: Testing mail.emerg May 11 17:14:32 black −− MARK −− ..... ..... Only the section of the interest in the huge varlogsyslog file is presented; the mail messages higher than the level: crit are presented in bold. Pay attention to the MARK messages generated by the syslogd daemon, in which logging is defined by the entry: mark.info varlogsyslog Generated mail log messages are also forwarded to the loghost for remote logging; this is the Solaris 2.6 system. Consequently, the loghosts etcsyslog.conf configuration file defines the way these messages will be locally logged. The loghost process receives remote messages in the same way as locally generated ones. The following syslog.conf entries at the loghost are related to the mail messages, and define their logging: .err;kern.debug;daemon.notic;mail.crit varadmmessages mail.debug varlogmaillog Checking the log files on the loghost: cat varadmmessages | grep black | grep mail May 11 16:58:54 black.logview.com bjl: Testing mail.crit May 11 16:59:12 black.logview.com bjl: Testing mail.alert May 11 16:59:29 black.logview.com bjl: Testing mail.emerg Only mail log messages received with a level higher than crit are logged in the varadmmessages file. However, all received mail log messages are logged in the loghosts file varlogmaillog, because the lowest logging level is defined as debug however, the debug mail message was not sent from the host black, because of the local logging configuration: cat varlogmaillog | grep black | grep Testing mail May 11 16:57:38 black.logview.com bjl: Testing mail.info May 11 16:58:04 black.logview.com bjl: Testing mail.notice May 11 16:58:23 black.logview.com bjl: Testing mail.warning May 11 16:58:39 black.logview.com bjl: Testing mail.err May 11 16:58:54 black.logview.com bjl: Testing mail.crit May 11 16:59:12 black.logview.com bjl: Testing mail.alert May 11 16:59:29 black.logview.com bjl: Testing mail.emerg

9.3 Accounting Log Files