Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Relevant part:

anisha@linux-trra~> sudo cat /var/log/messages
Aug 29 13:04:22 linux kernel: imklog 5.6.3, log source = /proc/kmsg started.
Aug 29 13:04:22 linux rsyslogd: [origin software="rsyslogd" swVersion="5.6.3" x-pid="1879" x-info="http://www.rsyslog.com"] start
Aug 29 13:04:22 linux kernel: [7.585951] type=1400 audit(1346225659.436:4): apparmor="STATUS" operation="profile_load" name="/sbin/syslog-ng" pid=807 comm="apparmor_parser" Aug 29 13:04:22 linux kernel: [7.667712] type=1400 audit(1346225659.518:5): apparmor="STATUS" operation="profile_load" name="/sbin/syslogd" pid=830 comm="apparmor_parser"

I couldn't find these PIDs on my system through ps -el.

  • How do the programs automatically know that they have to send messages to RSyslog?

  • Is it that all programs dump their messages at one place, and RSyslog picks up the relevant ones?

  • Man page of Syslog says that Syslog reads its messages from a socket in /dev. So, how does it correlate with the above two points?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

By default all syslog daemons read incoming messages from: /dev/log

Additionally syslog can bind to UDP socket on port 514. See /etc/services::

$ cat /etc/services | grep syslog
syslog          514/udp

Second is mostly used for passing logs between syslog daemons. I.e. one logging server per cluster.

As a programmer you don't directly write to /dev/log but instead you call a posix function syslog::

#include <syslog.h>

void openlog(const char *ident, int option, int facility);
void syslog(int priority, const char *format, ...);
void closelog(void);

In fact all higher level languages give you an abstraction layer on top of these functions.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.