I'm trying to understand what is the third parameter in my /var/log/messages file. For example:

$ logger test
$ grep test /var/log/messages


May 20 15:32:57 hostname **myusername**: test

Sometimes myusername is a process name, like httpd. But what's driving me crazy is that there are some lines that contain nonexistent user/daemon

For example:

May 20 15:32:57 hostname weirdname: some-http-request-here

What is weirdname? It's not in my /etc/passwd, not in my /etc/group, and is not a daemon/program.


From https://unix.stackexchange.com/a/278244/117549 -

The syslog format typically contains a timestamp, hostname, app name, and process ID along with whatever custom message was sent.

From https://tools.ietf.org/html/rfc5424#page-14:

The APP-NAME field SHOULD identify the device or application that originated the message. It is a string without further semantics. It is intended for filtering messages on a relay or collector. The NILVALUE MAY be used when the syslog application has no idea of its APP-NAME or cannot provide that information.

Try an example (Linux) for yourself:

logger -t weirdername "hello, self"
  • Thank you! I now understand that most probably Apache is responsible for this "weirdname" being logged. Instead of writing httpd to the log, it'd write weirdname as that was configured as one of the virtualhosts. – Blanq May 20 '16 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.