When an application logs using syslog does it mean that it stores the logs somewhere under /var/log? Or can it be elsewhere as well?

2 Answers 2


When an "application logs to syslog", it doesn't "store it's logs in /var/log" just like that. What it does is that it logs messages to something called a facility and a severity level.

The available facilities are:

auth, authpriv, daemon, cron, ftp, lpr, kern, mail, news, syslog, user, uucp, local0, local1, local2, local3, local4, local5, local6, local7

The available severities are:

emergency, alert, critical, error, warning, notice, info, debug

For example, the Linux kernel sends its messages (or "logs" its messages) to the facility called kern, and uses various severities to indicate the severity of the message; the Linux authentication mechanism logs to auth and authpriv; cron logs to cron, and so on. Other applications can be programmed/designed to log to the "local" facilities, local0 - local7, using different severity levels.

Now, the syslog daemon has a configuration file, usually /etc/syslog.conf. In this config file, we define where to save or send these messages. Some sample configuration lines from /etc/syslog.conf look like this:

kern.*                          /var/log/kern.log
mail.err                        /var/log/mail.err
*.*                             /var/log/syslog

The first line tells the syslog daemon to log kern.* messages (meaning facility kern and the * meaning all severities) to the file /var/log/kern.log, the second saves the mail facility and err severity messages to /var/log/mail.err, and the third logs everything to /var/log/syslog.

So, to answer your question, a message logs to a facility and severity, and the syslog.conf file is the one that decides where it's saved. But generally, the default configuration of syslog is that it saves to files under /var/log.


/var/log is simply the default location, you can change this via /etc/syslog.conf.

If you do change the location, make sure to also update the config for logrotate to point to the new location as well, otherwise your log files will grow unchecked. [hint: /etc/logrotate.conf and /etc/logrotate.d/]

  • 1
    On recent Debian and Ubuntu versions, logging for several facilities is actually handled by rsyslog. (Configured in /etc/rsyslog.conf and /etc/rsyslog.d/*.)
    – n.st
    Mar 25, 2014 at 3:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.