Relevant part:

anisha@linux-trra~> sudo cat /var/log/messages
Aug 29 13:04:22 linux kernel: imklog 5.6.3, log source = /proc/kmsg started.
Aug 29 13:04:22 linux rsyslogd: [origin software="rsyslogd" swVersion="5.6.3" x-pid="1879" x-info="http://www.rsyslog.com"] start
Aug 29 13:04:22 linux kernel: [7.585951] type=1400 audit(1346225659.436:4): apparmor="STATUS" operation="profile_load" name="/sbin/syslog-ng" pid=807 comm="apparmor_parser" Aug 29 13:04:22 linux kernel: [7.667712] type=1400 audit(1346225659.518:5): apparmor="STATUS" operation="profile_load" name="/sbin/syslogd" pid=830 comm="apparmor_parser"

I couldn't find these PIDs on my system through ps -el.

  • How do the programs automatically know that they have to send messages to RSyslog?

  • Is it that all programs dump their messages at one place, and RSyslog picks up the relevant ones?

  • Man page of Syslog says that Syslog reads its messages from a socket in /dev. So, how does it correlate with the above two points?


By default all syslog daemons read incoming messages from: /dev/log

Additionally syslog can bind to UDP socket on port 514. See /etc/services::

$ cat /etc/services | grep syslog
syslog          514/udp

Second is mostly used for passing logs between syslog daemons. I.e. one logging server per cluster.

As a programmer you don't directly write to /dev/log but instead you call a posix function syslog::

#include <syslog.h>

void openlog(const char *ident, int option, int facility);
void syslog(int priority, const char *format, ...);
void closelog(void);

In fact all higher level languages give you an abstraction layer on top of these functions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.